CVE-2014-2856: XSS
Published Apr 18, 2014
·Updated
Cross-site scripting (XSS) vulnerability in scheduler/client.c in Common Unix Printing System (CUPS) before 1.7.2 allows remote attackers to inject arbitrary web script or HTML via the URL path, related to the ispathabsolute function.
Affected Software
111 affected components
apple CUPS<=1.7.1
apple CUPS=1.1
apple CUPS=1.1.1
apple CUPS=1.1.2
apple CUPS=1.1.3
apple CUPS=1.1.4
apple CUPS=1.1.5
apple CUPS=1.1.5-1
apple CUPS=1.1.5-2
apple CUPS=1.1.6
apple CUPS=1.1.6-1
apple CUPS=1.1.6-2
apple CUPS=1.1.6-3
apple CUPS=1.1.7
apple CUPS=1.1.8
apple CUPS=1.1.9
apple CUPS=1.1.9-1
apple CUPS=1.1.10
apple CUPS=1.1.10-1
apple CUPS=1.1.11
apple CUPS=1.1.12
apple CUPS=1.1.13
apple CUPS=1.1.14
apple CUPS=1.1.15
apple CUPS=1.1.16
apple CUPS=1.1.17
apple CUPS=1.1.18
apple CUPS=1.1.19
apple CUPS=1.1.19-rc1
apple CUPS=1.1.19-rc2
apple CUPS=1.1.19-rc3
apple CUPS=1.1.19-rc4
apple CUPS=1.1.19-rc5
apple CUPS=1.1.20
apple CUPS=1.1.20-rc1
apple CUPS=1.1.20-rc2
apple CUPS=1.1.20-rc3
apple CUPS=1.1.20-rc4
apple CUPS=1.1.20-rc5
apple CUPS=1.1.20-rc6
apple CUPS=1.1.21
apple CUPS=1.1.21-rc1
apple CUPS=1.1.21-rc2
apple CUPS=1.1.22
apple CUPS=1.1.22-rc1
apple CUPS=1.1.22-rc2
apple CUPS=1.1.23
apple CUPS=1.1.23-rc1
apple CUPS=1.2-b1
apple CUPS=1.2-b2
apple CUPS=1.2-rc1
apple CUPS=1.2-rc2
apple CUPS=1.2-rc3
apple CUPS=1.2.0
apple CUPS=1.2.1
apple CUPS=1.2.2
apple CUPS=1.2.3
apple CUPS=1.2.4
apple CUPS=1.2.5
apple CUPS=1.2.6
apple CUPS=1.2.7
apple CUPS=1.2.8
apple CUPS=1.2.9
apple CUPS=1.2.10
apple CUPS=1.2.11
apple CUPS=1.2.12
apple CUPS=1.3-b1
apple CUPS=1.3-rc1
apple CUPS=1.3-rc2
apple CUPS=1.3.0
apple CUPS=1.3.1
apple CUPS=1.3.2
apple CUPS=1.3.3
apple CUPS=1.3.4
apple CUPS=1.3.5
apple CUPS=1.3.6
apple CUPS=1.3.7
apple CUPS=1.3.8
apple CUPS=1.3.9
apple CUPS=1.3.10
apple CUPS=1.3.11
apple CUPS=1.4-b1
apple CUPS=1.4-b2
apple CUPS=1.4-b3
apple CUPS=1.4-rc1
apple CUPS=1.4.0
apple CUPS=1.4.1
apple CUPS=1.4.2
apple CUPS=1.4.3
apple CUPS=1.4.4
apple CUPS=1.4.5
apple CUPS=1.4.6
apple CUPS=1.4.7
apple CUPS=1.4.8
apple CUPS=1.5-b1
apple CUPS=1.5-b2
apple CUPS=1.5-rc1
apple CUPS=1.5.0
apple CUPS=1.5.1
apple CUPS=1.5.2
apple CUPS=1.5.3
apple CUPS=1.5.4
apple CUPS=1.6-b1
apple CUPS=1.6-rc1
apple CUPS=1.6.1
apple CUPS=1.6.2
apple CUPS=1.6.3
apple CUPS=1.6.4
apple CUPS=1.7-rc1
apple CUPS=1.7.0
apple CUPS=1.7.1-b1
Event History
Apr 18, 2014
CVE Published
via MITRE·02:00 PM
Data Sourced
via MITRE·02:00 PM
Description
Data Sourced
via NVD·02:55 PM
DescriptionSeverityWeaknessAffected Software
Frequently Asked Questions
1
What is the severity of CVE-2014-2856?
CVE-2014-2856 is rated as a high severity vulnerability due to the risk of XSS attacks.
2
How do I fix CVE-2014-2856?
To resolve CVE-2014-2856, update the Common Unix Printing System (CUPS) to version 1.7.2 or later.
3
Which versions of CUPS are affected by CVE-2014-2856?
CVE-2014-2856 affects CUPS versions prior to 1.7.2, including multiple versions up to 1.7.1.
4
What type of vulnerability is CVE-2014-2856?
CVE-2014-2856 is a Cross-site Scripting (XSS) vulnerability.
5
Can CVE-2014-2856 be exploited remotely?
Yes, CVE-2014-2856 can be exploited by remote attackers to inject malicious scripts through the URL path.