CVE-2009-2820: XSS
Several cross-site scripting (XSS) flaws were found in the way CUPS web server interface used to process HTML form(s) content. A remote attacker could provide a specially-crafted HTML page(s), which once visited, by a local, unsuspecting user could lead to intended client-side security mechanisms bypass or, potentially, to injecting of malicious scripts into web pages, processed by CUPS web interface.
Acknowledgements:
Red Hat would like to thank Aaron Sigel of Apple Product Security for responsibly reporting this issue.
Other sources
The web interface in CUPS before 1.4.2, as used on Apple Mac OS X before 10.6.2 and other platforms, does not properly handle (1) HTTP headers and (2) HTML templates, which allows remote attackers to conduct cross-site scripting (XSS) attacks and HTTP response splitting attacks via vectors related to (a) the product's web interface, (b) the configuration of the print system, and (c) the titles of printed jobs, as demonstrated by an XSS attack that uses the kerberos parameter to the admin program, and leverages attribute injection and HTTP Parameter Pollution (HPP) issues.
— MITRE
Affected Software
Remediation
Patch Available
Patch Available
Event History
Frequently Asked Questions
What is the severity of CVE-2009-2820?
CVE-2009-2820 has a moderate severity rating due to its potential for cross-site scripting attacks.
How do I fix CVE-2009-2820?
To fix CVE-2009-2820, users should update their systems to the latest patched version of macOS that addresses this vulnerability.
What systems are affected by CVE-2009-2820?
CVE-2009-2820 affects multiple versions of macOS X, particularly versions ranging from 10.0 to 10.6.
Can CVE-2009-2820 lead to data theft?
Yes, if exploited, CVE-2009-2820 could allow attackers to execute scripts in a user's browser, potentially leading to data theft.
Is CVE-2009-2820 a critical vulnerability?
CVE-2009-2820 is not categorized as critical but still poses a risk, necessitating prompt remediation.