HP Multiple LaserJet Printers Cross Site Request Forgery Vulnerability

Bugtraq ID:	34143
Class:	Design Error
CVE:
Remote:	Yes
Local:	No
Published:	Mar 17 2009 12:00AM
Updated:	Mar 17 2009 05:16PM
Credit:	Henri Lindberg
Vulnerable:	HP LaserJet M1522n MFP 0 HP Embedded Web Server 0 HP Edgeline Printer 0 HP Digital Sender 0 HP Color LaserJet 2605dtn 0
Not Vulnerable:

HP Multiple LaserJet Printers Cross Site Request Forgery Vulnerability

Multiple HP printers are prone to a cross-site request-forgery vulnerability.

Exploiting this issue may allow a remote attacker to change a device's configuration and perform other unauthorized actions.

This issue affects HP LaserJet M1522n MFP and HP Color LaserJet 2605dtn. Other models in the LaserJet Printer, Edgeline Printer, and Digital Sender lines are also expected to be affected.

HP Multiple LaserJet Printers Cross Site Request Forgery Vulnerability

To exploit this issue, an attacker must entice an unsuspecting victim into following a malicious URI.

HP Multiple LaserJet Printers Cross Site Request Forgery Vulnerability

Solution:
Currently we are not aware of any vendor-supplied patches. If you feel we are in error or if you are aware of more recent information, please mail us at: [email protected].

HP Multiple LaserJet Printers Cross Site Request Forgery Vulnerability

References:

• Micro News Homepage (phptoys)
  
• HP Laserjet multiple models web management CSRF vulnerability & insecure default (Henri Lindberg )
  
• HP Security Notice HPSN-2009-001 rev.1 - HP LaserJet Printers, HP Edgeline Print (HP)