CVE-2021-20877

Cross-site scripting vulnerability in Canon laser printers and small office multifunctional printers (LBP162L/LBP162, MF4890dw, MF269dw/MF265dw/MF264dw/MF262dw, MF249dw/MF245dw/MF244dw/MF242dw/MF232w, and MF229dw/MF224dw/MF222dw sold in Japan, imageCLASS MF Series (MF113W/MF212W/MF217W/MF227DW/MF229DW, MF232W/MF244DW/MF247DW/MF249DW, MF264DW/MF267DW/MF269DW/MF269DW VP, and MF4570DN/MF4570DW/MF4770N/MF4880DW/MF4890DW) and imageCLASS LBP Series (LBP113W/LBP151DW/LBP162DW ) sold in the US, and iSENSYS (LBP162DW, LBP113W, LBP151DW, MF269dw, MF267dw, MF264dw, MF113w, MF249dw, MF247dw, MF244dw, MF237w, MF232w, MF229dw, MF217w, MF212w, MF4780w, and MF4890dw) and imageRUNNER (2206IF, 2204N, and 2204F) sold in Europe) allows remote attackers to inject an arbitrary script via unspecified vectors.

CVSS v3.0 4.8 MEDIUM
CVSS v2.0 3.5 LOW

4.8^/10

CVSS v3.0 : MEDIUM

V3 Legend

Vector :

Exploitability : 1.7 / Impact : 2.7

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required HIGH

User Interaction REQUIRED

Confidentiality Impact LOW

Integrity Impact LOW

Availability Impact NONE

Scope CHANGED

3.5^/10

CVSS v2.0 : LOW

V2 Legend

Vector : AV:N/AC:M/Au:S/C:N/I:P/A:N

Exploitability : 6.8 / Impact : 2.9

Access Vector NETWORK

Access Complexity MEDIUM

Authentication SINGLE

Confidentiality Impact NONE

Integrity Impact PARTIAL

Availability Impact NONE

References

Link	Resource
https://cweb.canon.jp/e-support/info/211221xss.html	Vendor Advisory
https://jvn.jp/en/jp/JVN64806328/index.html	Third Party Advisory
https://jvn.jp/jp/JVN64806328/index.html	Third Party Advisory
https://www.canon-europe.com/support/product-security-latest-news/	Vendor Advisory
https://www.usa.canon.com/internet/portal/us/home/support/product-advisories/detail/Service-Notice-Canon-Laser-Printer-and-Small-Office-Multifunctional-Printer-related-to-cross-site-scripting	Vendor Advisory

Configurations

Configuration 1 (hide)

OR	cpe:2.3:h:canon:2204f:-:::::::*
	cpe:2.3:h:canon:2204n:-:::::::*
	cpe:2.3:h:canon:2206if:-:::::::*
	cpe:2.3:h:canon:lbp113w:-:::::::*
	cpe:2.3:h:canon:lbp151dw:-:::::::*
	cpe:2.3:h:canon:lbp162:-:::::::*
	cpe:2.3:h:canon:lbp162dw:-:::::::*
	cpe:2.3:h:canon:lbp162l:-:::::::*
	cpe:2.3:h:canon:mf113w:-:::::::*
	cpe:2.3:h:canon:mf212w:-:::::::*
	cpe:2.3:h:canon:mf217w:-:::::::*
	cpe:2.3:h:canon:mf222dw:-:::::::*
	cpe:2.3:h:canon:mf224dw:-:::::::*
	cpe:2.3:h:canon:mf227dw:-:::::::*
	cpe:2.3:h:canon:mf229dw:-:::::::*
	cpe:2.3:h:canon:mf232w:-:::::::*
	cpe:2.3:h:canon:mf237w:-:::::::*
	cpe:2.3:h:canon:mf242dw:-:::::::*
	cpe:2.3:h:canon:mf244dw:-:::::::*
	cpe:2.3:h:canon:mf245dw:-:::::::*
	cpe:2.3:h:canon:mf247dw:-:::::::*
	cpe:2.3:h:canon:mf249dw:-:::::::*
	cpe:2.3:h:canon:mf262dw:-:::::::*
	cpe:2.3:h:canon:mf264dw:-:::::::*
	cpe:2.3:h:canon:mf265dw:-:::::::*
	cpe:2.3:h:canon:mf267dw:-:::::::*
	cpe:2.3:h:canon:mf269dw:-:::::::*
	cpe:2.3:h:canon:mf269dw_vp:-:::::::*
	cpe:2.3:h:canon:mf4570dn:-:::::::*
	cpe:2.3:h:canon:mf4570dw:-:::::::*
	cpe:2.3:h:canon:mf4770n:-:::::::*
	cpe:2.3:h:canon:mf4780w:-:::::::*
	cpe:2.3:h:canon:mf4880dw:-:::::::*
	cpe:2.3:h:canon:mf4890dw:-:::::::*

Information

Published : 2022-02-08 03:15

Updated : 2022-02-14 13:07

NVD link : CVE-2021-20877

Mitre link : CVE-2021-20877

JSON object : View

CWE

CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Products Affected

canon

mf4780w
mf247dw
lbp151dw
2204n
mf245dw
mf262dw
lbp162l
mf242dw
mf212w
2206if
2204f
mf237w
mf4880dw
mf229dw
mf4570dw
mf244dw
mf4570dn
mf264dw
mf113w
mf222dw
mf232w
mf267dw
mf224dw
mf269dw
mf4770n
mf4890dw
lbp162
mf227dw
lbp162dw
mf217w
mf265dw
mf269dw_vp
lbp113w
mf249dw

{"cve": {"data_type": "CVE", "references": {"reference_data": [{"url": "https://cweb.canon.jp/e-support/info/211221xss.html", "name": "https://cweb.canon.jp/e-support/info/211221xss.html", "tags": ["Vendor Advisory"], "refsource": "MISC"}, {"url": "https://jvn.jp/en/jp/JVN64806328/index.html", "name": "https://jvn.jp/en/jp/JVN64806328/index.html", "tags": ["Third Party Advisory"], "refsource": "MISC"}, {"url": "https://jvn.jp/jp/JVN64806328/index.html", "name": "https://jvn.jp/jp/JVN64806328/index.html", "tags": ["Third Party Advisory"], "refsource": "MISC"}, {"url": "https://www.canon-europe.com/support/product-security-latest-news/", "name": "https://www.canon-europe.com/support/product-security-latest-news/", "tags": ["Vendor Advisory"], "refsource": "MISC"}, {"url": "https://www.usa.canon.com/internet/portal/us/home/support/product-advisories/detail/Service-Notice-Canon-Laser-Printer-and-Small-Office-Multifunctional-Printer-related-to-cross-site-scripting", "name": "https://www.usa.canon.com/internet/portal/us/home/support/product-advisories/detail/Service-Notice-Canon-Laser-Printer-and-Small-Office-Multifunctional-Printer-related-to-cross-site-scripting", "tags": ["Vendor Advisory"], "refsource": "MISC"}]}, "data_format": "MITRE", "description": {"description_data": [{"lang": "en", "value": "Cross-site scripting vulnerability in Canon laser printers and small office multifunctional printers (LBP162L/LBP162, MF4890dw, MF269dw/MF265dw/MF264dw/MF262dw, MF249dw/MF245dw/MF244dw/MF242dw/MF232w, and MF229dw/MF224dw/MF222dw sold in Japan, imageCLASS MF Series (MF113W/MF212W/MF217W/MF227DW/MF229DW, MF232W/MF244DW/MF247DW/MF249DW, MF264DW/MF267DW/MF269DW/MF269DW VP, and MF4570DN/MF4570DW/MF4770N/MF4880DW/MF4890DW) and imageCLASS LBP Series (LBP113W/LBP151DW/LBP162DW ) sold in the US, and iSENSYS (LBP162DW, LBP113W, LBP151DW, MF269dw, MF267dw, MF264dw, MF113w, MF249dw, MF247dw, MF244dw, MF237w, MF232w, MF229dw, MF217w, MF212w, MF4780w, and MF4890dw) and imageRUNNER (2206IF, 2204N, and 2204F) sold in Europe) allows remote attackers to inject an arbitrary script via unspecified vectors."}]}, "problemtype": {"problemtype_data": [{"description": [{"lang": "en", "value": "CWE-79"}]}]}, "data_version": "4.0", "CVE_data_meta": {"ID": "CVE-2021-20877", "ASSIGNER": "vultures@jpcert.or.jp"}}, "impact": {"baseMetricV2": {"cvssV2": {"version": "2.0", "baseScore": 3.5, "accessVector": "NETWORK", "vectorString": "AV:N/AC:M/Au:S/C:N/I:P/A:N", "authentication": "SINGLE", "integrityImpact": "PARTIAL", "accessComplexity": "MEDIUM", "availabilityImpact": "NONE", "confidentialityImpact": "NONE"}, "severity": "LOW", "acInsufInfo": false, "impactScore": 2.9, "obtainAllPrivilege": false, "exploitabilityScore": 6.8, "obtainUserPrivilege": false, "obtainOtherPrivilege": false, "userInteractionRequired": true}, "baseMetricV3": {"cvssV3": {"scope": "CHANGED", "version": "3.1", "baseScore": 4.8, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N", "integrityImpact": "LOW", "userInteraction": "REQUIRED", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "HIGH", "confidentialityImpact": "LOW"}, "impactScore": 2.7, "exploitabilityScore": 1.7}}, "publishedDate": "2022-02-08T11:15Z", "configurations": {"nodes": [{"children": [], "operator": "OR", "cpe_match": [{"cpe23Uri": "cpe:2.3:h:canon:2204f:-:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true}, {"cpe23Uri": "cpe:2.3:h:canon:2204n:-:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true}, {"cpe23Uri": "cpe:2.3:h:canon:2206if:-:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true}, {"cpe23Uri": "cpe:2.3:h:canon:lbp113w:-:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true}, {"cpe23Uri": "cpe:2.3:h:canon:lbp151dw:-:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true}, {"cpe23Uri": "cpe:2.3:h:canon:lbp162:-:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true}, {"cpe23Uri": "cpe:2.3:h:canon:lbp162dw:-:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true}, {"cpe23Uri": "cpe:2.3:h:canon:lbp162l:-:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true}, {"cpe23Uri": "cpe:2.3:h:canon:mf113w:-:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true}, {"cpe23Uri": "cpe:2.3:h:canon:mf212w:-:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true}, {"cpe23Uri": "cpe:2.3:h:canon:mf217w:-:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true}, {"cpe23Uri": "cpe:2.3:h:canon:mf222dw:-:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true}, {"cpe23Uri": "cpe:2.3:h:canon:mf224dw:-:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true}, {"cpe23Uri": "cpe:2.3:h:canon:mf227dw:-:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true}, {"cpe23Uri": "cpe:2.3:h:canon:mf229dw:-:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true}, {"cpe23Uri": "cpe:2.3:h:canon:mf232w:-:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true}, {"cpe23Uri": "cpe:2.3:h:canon:mf237w:-:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true}, {"cpe23Uri": "cpe:2.3:h:canon:mf242dw:-:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true}, {"cpe23Uri": "cpe:2.3:h:canon:mf244dw:-:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true}, {"cpe23Uri": "cpe:2.3:h:canon:mf245dw:-:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true}, {"cpe23Uri": "cpe:2.3:h:canon:mf247dw:-:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true}, {"cpe23Uri": "cpe:2.3:h:canon:mf249dw:-:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true}, {"cpe23Uri": "cpe:2.3:h:canon:mf262dw:-:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true}, {"cpe23Uri": "cpe:2.3:h:canon:mf264dw:-:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true}, {"cpe23Uri": "cpe:2.3:h:canon:mf265dw:-:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true}, {"cpe23Uri": "cpe:2.3:h:canon:mf267dw:-:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true}, {"cpe23Uri": "cpe:2.3:h:canon:mf269dw:-:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true}, {"cpe23Uri": "cpe:2.3:h:canon:mf269dw_vp:-:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true}, {"cpe23Uri": "cpe:2.3:h:canon:mf4570dn:-:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true}, {"cpe23Uri": "cpe:2.3:h:canon:mf4570dw:-:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true}, {"cpe23Uri": "cpe:2.3:h:canon:mf4770n:-:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true}, {"cpe23Uri": "cpe:2.3:h:canon:mf4780w:-:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true}, {"cpe23Uri": "cpe:2.3:h:canon:mf4880dw:-:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true}, {"cpe23Uri": "cpe:2.3:h:canon:mf4890dw:-:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true}]}], "CVE_data_version": "4.0"}, "lastModifiedDate": "2022-02-14T21:07Z"}

4.8 /10

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required HIGH

User Interaction REQUIRED

Confidentiality Impact LOW

Integrity Impact LOW

Availability Impact NONE

Scope CHANGED

3.5 /10

Access Vector NETWORK

Access Complexity MEDIUM

Authentication SINGLE

Confidentiality Impact NONE

Integrity Impact PARTIAL

Availability Impact NONE

JSON object

Attach tags to CVE-2021-20877

4.8^/10

3.5^/10

Attach tags to `CVE-2021-20877`