HP Multiple LaserJet Printers CVE-2012-3272 Cross Site Scripting Vulnerability

Bugtraq ID:	56820
Class:	Input Validation Error
CVE:	CVE-2012-3272
Remote:	Yes
Local:	No
Published:	Dec 03 2012 12:00AM
Updated:	Dec 03 2012 12:00AM
Credit:	Dominic Sim of KPMG
Vulnerable:	HP LaserJet P4515 0 HP LaserJet P4015 0 HP LaserJet P4014 0 HP LaserJet P3015 0 HP Color LaserJet CP4525 0 HP Color LaserJet CP4025 0 HP Color LaserJet CM6040 0 HP Color LaserJet CM6030 0 HP Color LaserJet CM3530 0 HP Color LaserJet CP6015 HP Color LaserJet CP3525
Not Vulnerable:

HP Multiple LaserJet Printers CVE-2012-3272 Cross Site Scripting Vulnerability

Multiple HP printers are prone to a cross-site scripting vulnerability because it fails to sufficiently sanitize user-supplied data.

An attacker may leverage this issue to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may allow the attacker to steal cookie-based authentication credentials and launch other attacks.

HP Multiple LaserJet Printers CVE-2012-3272 Cross Site Scripting Vulnerability

To exploit this issue, an attacker must entice an unsuspecting victim into following a malicious URI.

HP Multiple LaserJet Printers CVE-2012-3272 Cross Site Scripting Vulnerability

Solution:
Vendor updates are available. Please see the references for more information.

HP Multiple LaserJet Printers CVE-2012-3272 Cross Site Scripting Vulnerability

References:

• Micro News Homepage (phptoys)
  
• HPSBPI02828 SSRT100778 rev.1 - HP LaserJet and Color LaserJet, Cross-Site Script (HP)