CVE-2013-6033

Multiple cross-site scripting (XSS) vulnerabilities on Lexmark W840 through LS.HA.P252, T64x before LS.ST.P344, C935dn through LC.JO.P091, C920 through LS.TA.P152, C53x through LS.SW.P069, C52x through LS.FA.P150, E450 through LM.SZ.P124, E350 through LE.PH.P129, and E250 through LE.PM.P126 printers allow remote authenticated users to inject arbitrary web script or HTML by using (1) SNMP or (2) the Embedded Web Server (EWS) to set the (a) Contact or (b) Location field.

CVSS v2.0 3.5 LOW

3.5^/10

CVSS v2.0 : LOW

Vector : AV:N/AC:M/Au:S/C:N/I:P/A:N

Exploitability : 6.8 / Impact : 2.9

Access Vector NETWORK

Access Complexity MEDIUM

Authentication SINGLE

Confidentiality Impact NONE

Integrity Impact PARTIAL

Availability Impact NONE

References

Link	Resource
http://www.kb.cert.org/vuls/id/108062	US Government Resource
http://www.securityfocus.com/bid/65277
http://www.osvdb.org/102752
http://support.lexmark.com/index?page=content&id=TE585	Vendor Advisory

Advertisement

Configurations

Configuration 1 (hide)

OR	cpe:2.3:h:lexmark:e450::::::::
	cpe:2.3:h:lexmark:c52x::::::::
	cpe:2.3:h:lexmark:c53x::::::::
	cpe:2.3:h:lexmark:c920::::::::
	cpe:2.3:h:lexmark:c935dn::::::::
	cpe:2.3:h:lexmark:e350::::::::
	cpe:2.3:h:lexmark:w840::::::::
	cpe:2.3:h:lexmark:e250::::::::
	cpe:2.3:h:lexmark:t64x::::::::

Information

Published : 2014-02-03 21:39

Updated : 2014-02-04 07:37

NVD link : CVE-2013-6033

Mitre link : CVE-2013-6033

JSON object : View

CWE

CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Advertisement

Products Affected

lexmark

c920
c935dn
c52x
e250
t64x
e450
w840
e350
c53x

{"cve": {"data_type": "CVE", "references": {"reference_data": [{"url": "http://www.kb.cert.org/vuls/id/108062", "name": "VU#108062", "tags": ["US Government Resource"], "refsource": "CERT-VN"}, {"url": "http://www.securityfocus.com/bid/65277", "name": "65277", "tags": [], "refsource": "BID"}, {"url": "http://www.osvdb.org/102752", "name": "102752", "tags": [], "refsource": "OSVDB"}, {"url": "http://support.lexmark.com/index?page=content&id=TE585", "name": "http://support.lexmark.com/index?page=content&id=TE585", "tags": ["Vendor Advisory"], "refsource": "CONFIRM"}]}, "data_format": "MITRE", "description": {"description_data": [{"lang": "en", "value": "Multiple cross-site scripting (XSS) vulnerabilities on Lexmark W840 through LS.HA.P252, T64x before LS.ST.P344, C935dn through LC.JO.P091, C920 through LS.TA.P152, C53x through LS.SW.P069, C52x through LS.FA.P150, E450 through LM.SZ.P124, E350 through LE.PH.P129, and E250 through LE.PM.P126 printers allow remote authenticated users to inject arbitrary web script or HTML by using (1) SNMP or (2) the Embedded Web Server (EWS) to set the (a) Contact or (b) Location field."}]}, "problemtype": {"problemtype_data": [{"description": [{"lang": "en", "value": "CWE-79"}]}]}, "data_version": "4.0", "CVE_data_meta": {"ID": "CVE-2013-6033", "ASSIGNER": "cert@cert.org"}}, "impact": {"baseMetricV2": {"cvssV2": {"version": "2.0", "baseScore": 3.5, "accessVector": "NETWORK", "vectorString": "AV:N/AC:M/Au:S/C:N/I:P/A:N", "authentication": "SINGLE", "integrityImpact": "PARTIAL", "accessComplexity": "MEDIUM", "availabilityImpact": "NONE", "confidentialityImpact": "NONE"}, "severity": "LOW", "impactScore": 2.9, "obtainAllPrivilege": false, "exploitabilityScore": 6.8, "obtainUserPrivilege": false, "obtainOtherPrivilege": false, "userInteractionRequired": true}}, "publishedDate": "2014-02-04T05:39Z", "configurations": {"nodes": [{"children": [], "operator": "OR", "cpe_match": [{"cpe23Uri": "cpe:2.3:h:lexmark:e450:*:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true, "versionEndIncluding": "lm.sz.p124"}, {"cpe23Uri": "cpe:2.3:h:lexmark:c52x:*:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true, "versionEndIncluding": "ls.fa.p150"}, {"cpe23Uri": "cpe:2.3:h:lexmark:c53x:*:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true, "versionEndIncluding": "ls.sw.p069"}, {"cpe23Uri": "cpe:2.3:h:lexmark:c920:*:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true, "versionEndIncluding": "ls.ta.p152"}, {"cpe23Uri": "cpe:2.3:h:lexmark:c935dn:*:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true, "versionEndIncluding": "lc.jo.p091"}, {"cpe23Uri": "cpe:2.3:h:lexmark:e350:*:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true, "versionEndIncluding": "le.ph.p129"}, {"cpe23Uri": "cpe:2.3:h:lexmark:w840:*:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true, "versionEndIncluding": "ls.ha.p252"}, {"cpe23Uri": "cpe:2.3:h:lexmark:e250:*:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true, "versionEndIncluding": "le.pm.p126"}, {"cpe23Uri": "cpe:2.3:h:lexmark:t64x:*:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true, "versionEndIncluding": "ls.st.p343"}]}], "CVE_data_version": "4.0"}, "lastModifiedDate": "2014-02-04T15:37Z"}