Lucene search
HistoryApr 18, 2014 - 2:55 p.m.
CVE-2014-2856
CVSS2
4.3
Attack Vector
NETWORK
Attack Complexity
MEDIUM
Authentication
NONE
Confidentiality Impact
NONE
Integrity Impact
PARTIAL
Availability Impact
NONE
AV:N/AC:M/Au:N/C:N/I:P/A:N
AI Score
7.2
Confidence
High
EPSS
0.009
Percentile
82.4%
Cross-site scripting (XSS) vulnerability in scheduler/client.c in Common Unix Printing System (CUPS) before 1.7.2 allows remote attackers to inject arbitrary web script or HTML via the URL path, related to the is_path_absolute function.
Affected configurations
Node
applecupsRange≤1.7.1
ORapplecupsMatch1.1
ORapplecupsMatch1.1.1
ORapplecupsMatch1.1.2
ORapplecupsMatch1.1.3
ORapplecupsMatch1.1.4
ORapplecupsMatch1.1.5
ORapplecupsMatch1.1.5-1
ORapplecupsMatch1.1.5-2
ORapplecupsMatch1.1.6
ORapplecupsMatch1.1.6-1
ORapplecupsMatch1.1.6-2
ORapplecupsMatch1.1.6-3
ORapplecupsMatch1.1.7
ORapplecupsMatch1.1.8
ORapplecupsMatch1.1.9
ORapplecupsMatch1.1.9-1
ORapplecupsMatch1.1.10
ORapplecupsMatch1.1.10-1
ORapplecupsMatch1.1.11
ORapplecupsMatch1.1.12
ORapplecupsMatch1.1.13
ORapplecupsMatch1.1.14
ORapplecupsMatch1.1.15
ORapplecupsMatch1.1.16
ORapplecupsMatch1.1.17
ORapplecupsMatch1.1.18
ORapplecupsMatch1.1.19
ORapplecupsMatch1.1.19rc1
ORapplecupsMatch1.1.19rc2
ORapplecupsMatch1.1.19rc3
ORapplecupsMatch1.1.19rc4
ORapplecupsMatch1.1.19rc5
ORapplecupsMatch1.1.20
ORapplecupsMatch1.1.20rc1
ORapplecupsMatch1.1.20rc2
ORapplecupsMatch1.1.20rc3
ORapplecupsMatch1.1.20rc4
ORapplecupsMatch1.1.20rc5
ORapplecupsMatch1.1.20rc6
ORapplecupsMatch1.1.21
ORapplecupsMatch1.1.21rc1
ORapplecupsMatch1.1.21rc2
ORapplecupsMatch1.1.22
ORapplecupsMatch1.1.22rc1
ORapplecupsMatch1.1.22rc2
ORapplecupsMatch1.1.23
ORapplecupsMatch1.1.23rc1
ORapplecupsMatch1.2b1
ORapplecupsMatch1.2b2
ORapplecupsMatch1.2rc1
ORapplecupsMatch1.2rc2
ORapplecupsMatch1.2rc3
ORapplecupsMatch1.2.0
ORapplecupsMatch1.2.1
ORapplecupsMatch1.2.2
ORapplecupsMatch1.2.3
ORapplecupsMatch1.2.4
ORapplecupsMatch1.2.5
ORapplecupsMatch1.2.6
ORapplecupsMatch1.2.7
ORapplecupsMatch1.2.8
ORapplecupsMatch1.2.9
ORapplecupsMatch1.2.10
ORapplecupsMatch1.2.11
ORapplecupsMatch1.2.12
ORapplecupsMatch1.3b1
ORapplecupsMatch1.3rc1
ORapplecupsMatch1.3rc2
ORapplecupsMatch1.3.0
ORapplecupsMatch1.3.1
ORapplecupsMatch1.3.2
ORapplecupsMatch1.3.3
ORapplecupsMatch1.3.4
ORapplecupsMatch1.3.5
ORapplecupsMatch1.3.6
ORapplecupsMatch1.3.7
ORapplecupsMatch1.3.8
ORapplecupsMatch1.3.9
ORapplecupsMatch1.3.10
ORapplecupsMatch1.3.11
ORapplecupsMatch1.4b1
ORapplecupsMatch1.4b2
ORapplecupsMatch1.4b3
ORapplecupsMatch1.4rc1
ORapplecupsMatch1.4.0
ORapplecupsMatch1.4.1
ORapplecupsMatch1.4.2
ORapplecupsMatch1.4.3
ORapplecupsMatch1.4.4
ORapplecupsMatch1.4.5
ORapplecupsMatch1.4.6
ORapplecupsMatch1.4.7
ORapplecupsMatch1.4.8
ORapplecupsMatch1.5b1
ORapplecupsMatch1.5b2
ORapplecupsMatch1.5rc1
ORapplecupsMatch1.5.0
ORapplecupsMatch1.5.1
ORapplecupsMatch1.5.2
ORapplecupsMatch1.5.3
ORapplecupsMatch1.5.4
ORapplecupsMatch1.6b1
ORapplecupsMatch1.6rc1
ORapplecupsMatch1.6.1
ORapplecupsMatch1.6.2
ORapplecupsMatch1.6.3
ORapplecupsMatch1.6.4
ORapplecupsMatch1.7rc1
ORapplecupsMatch1.7.0
ORapplecupsMatch1.7.1b1
| Vendor | Product | Version | CPE |
|---|---|---|---|
| apple | cups | * | cpe:2.3:a:apple:cups:*:*:*:*:*:*:*:* |
| apple | cups | 1.1 | cpe:2.3:a:apple:cups:1.1:*:*:*:*:*:*:* |
| apple | cups | 1.1.1 | cpe:2.3:a:apple:cups:1.1.1:*:*:*:*:*:*:* |
| apple | cups | 1.1.2 | cpe:2.3:a:apple:cups:1.1.2:*:*:*:*:*:*:* |
| apple | cups | 1.1.3 | cpe:2.3:a:apple:cups:1.1.3:*:*:*:*:*:*:* |
| apple | cups | 1.1.4 | cpe:2.3:a:apple:cups:1.1.4:*:*:*:*:*:*:* |
| apple | cups | 1.1.5 | cpe:2.3:a:apple:cups:1.1.5:*:*:*:*:*:*:* |
| apple | cups | 1.1.5-1 | cpe:2.3:a:apple:cups:1.1.5-1:*:*:*:*:*:*:* |
| apple | cups | 1.1.5-2 | cpe:2.3:a:apple:cups:1.1.5-2:*:*:*:*:*:*:* |
| apple | cups | 1.1.6 | cpe:2.3:a:apple:cups:1.1.6:*:*:*:*:*:*:* |
References
advisories.mageia.org/MGASA-2014-0193.html
rhn.redhat.com/errata/RHSA-2014-1388.html
secunia.com/advisories/57880
www.cups.org/documentation.php/relnotes.html
www.cups.org/str.php?L4356
www.mandriva.com/security/advisories?name=MDVSA-2015:108
www.openwall.com/lists/oss-security/2014/04/14/2
www.openwall.com/lists/oss-security/2014/04/15/3
www.securityfocus.com/bid/66788
www.ubuntu.com/usn/USN-2172-1
Related
veracode
veracode
Cross-site Scripting (XSS)
2019-01-15 09:02:22
openvas
openvas
CUPS Web Interface < 1.7.2 XSS Vulnerability
2014-04-22 00:00:00
Fedora Update for cups FEDORA-2014-5079
2014-05-05 00:00:00
Ubuntu Update for cups USN-2172-1
2014-05-02 00:00:00
cve
cve
CVE-2014-2856
2014-04-18 14:55:26
checkpoint_advisories
checkpoint_advisories
prion
prion
Cross site scripting
2014-04-18 14:55:00
fedora
fedora
[SECURITY] Fedora 19 Update: cups-1.6.4-5.fc19
2014-04-29 05:24:35
[SECURITY] Fedora 20 Update: cups-1.7.2-1.fc20
2014-04-30 04:08:38
mageia
mageia
Updated cups packages fix CVE-2014-2856
2014-04-24 23:10:04
nessus
nessus
Fedora 19 : cups-1.6.4-5.fc19 (2014-4384)
2014-04-29 00:00:00
CUPS < 1.7.2 is_path_absolute Function XSS
2014-04-28 00:00:00
Mandriva Linux Security Advisory : cups (MDVSA-2014:091)
2014-05-19 00:00:00
securityvulns
securityvulns
CUPS crossite scripting
2014-05-04 00:00:00
[USN-2172-1] CUPS vulnerability
2014-05-04 00:00:00
cvelist
cvelist
CVE-2014-2856
2014-04-18 14:00:00
debiancve
debiancve
CVE-2014-2856
2014-04-18 14:55:26
ubuntu
ubuntu
CUPS vulnerability
2014-04-24 00:00:00
ubuntucve
ubuntucve
CVE-2014-2856
2014-04-18 00:00:00
redhat
redhat
(RHSA-2014:1388) Moderate: cups security and bug fix update
2014-10-14 00:00:00
centos
centos
cups security update
2014-10-20 18:08:35
amazon
amazon
Medium: cups
2014-10-28 17:17:00
oraclelinux
oraclelinux
cups security and bug fix update
2014-10-15 00:00:00
osv
osv
cups-2.1.3-2.3 on GA media
2024-06-15 00:00:00
CVSS2
4.3
Attack Vector
NETWORK
Attack Complexity
MEDIUM
Authentication
NONE
Confidentiality Impact
NONE
Integrity Impact
PARTIAL
Availability Impact
NONE
AV:N/AC:M/Au:N/C:N/I:P/A:N
AI Score
7.2
Confidence
High
EPSS
0.009
Percentile
82.4%
Related for NVD:CVE-2014-2856