CVE-2009-0940

Description

Multiple cross-site request forgery (CSRF) vulnerabilities in the HP Embedded Web Server (EWS) on HP LaserJet Printers, Edgeline Printers, and Digital Senders allow remote attackers to hijack the intranet connectivity of arbitrary users for requests that (1) print documents via unknown vectors, (2) modify the network configuration via a NetIPChange request to hp/device/config_result_YesNo.html/config, or (3) change the password via the Password and ConfirmPassword parameters to hp/device/set_config_password.html/config.

References

http://www.vupen.com/english/advisories/2009/0754

http://www.securityfocus.com/bid/34143

http://www.securityfocus.com/archive/1/501884/100/0/threaded

http://osvdb.org/52849

http://osvdb.org/52848

http://osvdb.org/52847

http://h20000.www2.hp.com/bizsupport/TechSupport/Document.jsp?objectID=c01684566

Details

Source: Mitre, NVD

Risk Information

CVSS v2

CVSS v3

EPSS