github - ghsa-rf22-cg75-72hc

ghsa-rf22-cg75-72hc

Vulnerability from github

Published

2022-05-02 03:20

Modified

2022-05-02 03:20

Details

Multiple cross-site request forgery (CSRF) vulnerabilities in the HP Embedded Web Server (EWS) on HP LaserJet Printers, Edgeline Printers, and Digital Senders allow remote attackers to hijack the intranet connectivity of arbitrary users for requests that (1) print documents via unknown vectors, (2) modify the network configuration via a NetIPChange request to hp/device/config_result_YesNo.html/config, or (3) change the password via the Password and ConfirmPassword parameters to hp/device/set_config_password.html/config.

Show details on source website

JSON

To clipboard

{
  "affected": [],
  "aliases": [
    "CVE-2009-0940"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-352"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2009-03-18T21:00:00Z",
    "severity": "MODERATE"
  },
  "details": "Multiple cross-site request forgery (CSRF) vulnerabilities in the HP Embedded Web Server (EWS) on HP LaserJet Printers, Edgeline Printers, and Digital Senders allow remote attackers to hijack the intranet connectivity of arbitrary users for requests that (1) print documents via unknown vectors, (2) modify the network configuration via a NetIPChange request to hp/device/config_result_YesNo.html/config, or (3) change the password via the Password and ConfirmPassword parameters to hp/device/set_config_password.html/config.",
  "id": "GHSA-rf22-cg75-72hc",
  "modified": "2022-05-02T03:20:00Z",
  "published": "2022-05-02T03:20:00Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2009-0940"
    },
    {
      "type": "WEB",
      "url": "http://h20000.www2.hp.com/bizsupport/TechSupport/Document.jsp?objectID=c01684566"
    },
    {
      "type": "WEB",
      "url": "http://osvdb.org/52847"
    },
    {
      "type": "WEB",
      "url": "http://osvdb.org/52848"
    },
    {
      "type": "WEB",
      "url": "http://osvdb.org/52849"
    },
    {
      "type": "WEB",
      "url": "http://www.louhinetworks.fi/advisory/HP_20090317.txt"
    },
    {
      "type": "WEB",
      "url": "http://www.securityfocus.com/archive/1/501884/100/0/threaded"
    },
    {
      "type": "WEB",
      "url": "http://www.securityfocus.com/bid/34143"
    },
    {
      "type": "WEB",
      "url": "http://www.vupen.com/english/advisories/2009/0754"
    }
  ],
  "schema_version": "1.4.0",
  "severity": []
}

cve-2009-0940

Vulnerability from cvelistv5

Published

2009-03-18 20:35

Modified

2024-08-07 04:57

Severity ?

Summary

References

▼	URL	Tags
	http://www.vupen.com/english/advisories/2009/0754	vdb-entry, x_refsource_VUPEN
	http://h20000.www2.hp.com/bizsupport/TechSupport/Document.jsp?objectID=c01684566	vendor-advisory, x_refsource_HP
	http://osvdb.org/52848	vdb-entry, x_refsource_OSVDB
	http://www.securityfocus.com/bid/34143	vdb-entry, x_refsource_BID
	http://osvdb.org/52849	vdb-entry, x_refsource_OSVDB
	http://www.securityfocus.com/archive/1/501884/100/0/threaded	mailing-list, x_refsource_BUGTRAQ
	http://www.louhinetworks.fi/advisory/HP_20090317.txt	x_refsource_MISC
	http://osvdb.org/52847	vdb-entry, x_refsource_OSVDB

Impacted products

Vendor

Product

Version

▼

n/a

Version: n/a

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-07T04:57:17.078Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "name": "ADV-2009-0754",
            "tags": [
              "vdb-entry",
              "x_refsource_VUPEN",
              "x_transferred"
            ],
            "url": "http://www.vupen.com/english/advisories/2009/0754"
          },
          {
            "name": "HPSN-2009-001",
            "tags": [
              "vendor-advisory",
              "x_refsource_HP",
              "x_transferred"
            ],
            "url": "http://h20000.www2.hp.com/bizsupport/TechSupport/Document.jsp?objectID=c01684566"
          },
          {
            "name": "52848",
            "tags": [
              "vdb-entry",
              "x_refsource_OSVDB",
              "x_transferred"
            ],
            "url": "http://osvdb.org/52848"
          },
          {
            "name": "34143",
            "tags": [
              "vdb-entry",
              "x_refsource_BID",
              "x_transferred"
            ],
            "url": "http://www.securityfocus.com/bid/34143"
          },
          {
            "name": "52849",
            "tags": [
              "vdb-entry",
              "x_refsource_OSVDB",
              "x_transferred"
            ],
            "url": "http://osvdb.org/52849"
          },
          {
            "name": "20090316 HP Laserjet multiple models web management CSRF vulnerability \u0026 insecure default configuration",
            "tags": [
              "mailing-list",
              "x_refsource_BUGTRAQ",
              "x_transferred"
            ],
            "url": "http://www.securityfocus.com/archive/1/501884/100/0/threaded"
          },
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "http://www.louhinetworks.fi/advisory/HP_20090317.txt"
          },
          {
            "name": "52847",
            "tags": [
              "vdb-entry",
              "x_refsource_OSVDB",
              "x_transferred"
            ],
            "url": "http://osvdb.org/52847"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "n/a",
          "vendor": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "n/a"
            }
          ]
        }
      ],
      "datePublic": "2009-03-16T00:00:00",
      "descriptions": [
        {
          "lang": "en",
          "value": "Multiple cross-site request forgery (CSRF) vulnerabilities in the HP Embedded Web Server (EWS) on HP LaserJet Printers, Edgeline Printers, and Digital Senders allow remote attackers to hijack the intranet connectivity of arbitrary users for requests that (1) print documents via unknown vectors, (2) modify the network configuration via a NetIPChange request to hp/device/config_result_YesNo.html/config, or (3) change the password via the Password and ConfirmPassword parameters to hp/device/set_config_password.html/config."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "n/a",
              "lang": "en",
              "type": "text"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2018-10-10T18:57:01",
        "orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
        "shortName": "mitre"
      },
      "references": [
        {
          "name": "ADV-2009-0754",
          "tags": [
            "vdb-entry",
            "x_refsource_VUPEN"
          ],
          "url": "http://www.vupen.com/english/advisories/2009/0754"
        },
        {
          "name": "HPSN-2009-001",
          "tags": [
            "vendor-advisory",
            "x_refsource_HP"
          ],
          "url": "http://h20000.www2.hp.com/bizsupport/TechSupport/Document.jsp?objectID=c01684566"
        },
        {
          "name": "52848",
          "tags": [
            "vdb-entry",
            "x_refsource_OSVDB"
          ],
          "url": "http://osvdb.org/52848"
        },
        {
          "name": "34143",
          "tags": [
            "vdb-entry",
            "x_refsource_BID"
          ],
          "url": "http://www.securityfocus.com/bid/34143"
        },
        {
          "name": "52849",
          "tags": [
            "vdb-entry",
            "x_refsource_OSVDB"
          ],
          "url": "http://osvdb.org/52849"
        },
        {
          "name": "20090316 HP Laserjet multiple models web management CSRF vulnerability \u0026 insecure default configuration",
          "tags": [
            "mailing-list",
            "x_refsource_BUGTRAQ"
          ],
          "url": "http://www.securityfocus.com/archive/1/501884/100/0/threaded"
        },
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "http://www.louhinetworks.fi/advisory/HP_20090317.txt"
        },
        {
          "name": "52847",
          "tags": [
            "vdb-entry",
            "x_refsource_OSVDB"
          ],
          "url": "http://osvdb.org/52847"
        }
      ],
      "x_legacyV4Record": {
        "CVE_data_meta": {
          "ASSIGNER": "cve@mitre.org",
          "ID": "CVE-2009-0940",
          "STATE": "PUBLIC"
        },
        "affects": {
          "vendor": {
            "vendor_data": [
              {
                "product": {
                  "product_data": [
                    {
                      "product_name": "n/a",
                      "version": {
                        "version_data": [
                          {
                            "version_value": "n/a"
                          }
                        ]
                      }
                    }
                  ]
                },
                "vendor_name": "n/a"
              }
            ]
          }
        },
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "eng",
              "value": "Multiple cross-site request forgery (CSRF) vulnerabilities in the HP Embedded Web Server (EWS) on HP LaserJet Printers, Edgeline Printers, and Digital Senders allow remote attackers to hijack the intranet connectivity of arbitrary users for requests that (1) print documents via unknown vectors, (2) modify the network configuration via a NetIPChange request to hp/device/config_result_YesNo.html/config, or (3) change the password via the Password and ConfirmPassword parameters to hp/device/set_config_password.html/config."
            }
          ]
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "eng",
                  "value": "n/a"
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "ADV-2009-0754",
              "refsource": "VUPEN",
              "url": "http://www.vupen.com/english/advisories/2009/0754"
            },
            {
              "name": "HPSN-2009-001",
              "refsource": "HP",
              "url": "http://h20000.www2.hp.com/bizsupport/TechSupport/Document.jsp?objectID=c01684566"
            },
            {
              "name": "52848",
              "refsource": "OSVDB",
              "url": "http://osvdb.org/52848"
            },
            {
              "name": "34143",
              "refsource": "BID",
              "url": "http://www.securityfocus.com/bid/34143"
            },
            {
              "name": "52849",
              "refsource": "OSVDB",
              "url": "http://osvdb.org/52849"
            },
            {
              "name": "20090316 HP Laserjet multiple models web management CSRF vulnerability \u0026 insecure default configuration",
              "refsource": "BUGTRAQ",
              "url": "http://www.securityfocus.com/archive/1/501884/100/0/threaded"
            },
            {
              "name": "http://www.louhinetworks.fi/advisory/HP_20090317.txt",
              "refsource": "MISC",
              "url": "http://www.louhinetworks.fi/advisory/HP_20090317.txt"
            },
            {
              "name": "52847",
              "refsource": "OSVDB",
              "url": "http://osvdb.org/52847"
            }
          ]
        }
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
    "assignerShortName": "mitre",
    "cveId": "CVE-2009-0940",
    "datePublished": "2009-03-18T20:35:00",
    "dateReserved": "2009-03-18T00:00:00",
    "dateUpdated": "2024-08-07T04:57:17.078Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

Sightings

Author	Source	Type	Date

Nomenclature

Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
Confirmed: The vulnerability is confirmed from an analyst perspective.
Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
Patched: This vulnerability was successfully patched by the user reporting the sighting.
Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
Not confirmed: The user expresses doubt about the veracity of the vulnerability.
Not patched: This vulnerability was not successfully patched by the user reporting the sighting.

Action not permitted