CVE-2015-1159: XSS
Cross-site scripting (XSS) vulnerability in the cgiputs function in cgi-bin/template.c in the template engine in CUPS before 2.0.3 allows remote attackers to inject arbitrary web script or HTML via the QUERY parameter to help/.
Other sources
The following flaw was found in CUPS:
A cross-site scripting bug in the CUPS templating engine allows this bug to be exploited when a user browses the web. This XSS is reachable in the default configuration for Linux instances of CUPS, and allows an attacker to bypass default configuration settings that bind the CUPS scheduler to the 'localhost' or loopback interface.
Acknowledgements:
Red Hat would like to thank the CERT/CC for reporting this issue.
— Red Hat
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2015-1159?
CVE-2015-1159 is classified as a high-severity vulnerability due to the potential for cross-site scripting attacks.
How do I fix CVE-2015-1159?
To fix CVE-2015-1159, upgrade to CUPS version 2.0.3 or later, where the vulnerability is addressed.
What systems are affected by CVE-2015-1159?
CVE-2015-1159 affects CUPS versions prior to 2.0.3 running on various operating systems.
Can CVE-2015-1159 lead to data theft?
Yes, CVE-2015-1159 can allow attackers to execute scripts that may facilitate data theft or unauthorized actions on behalf of users.
Is CVE-2015-1159 specific to any browser?
CVE-2015-1159 is not specific to any particular browser, as the vulnerability occurs within CUPS and can affect any client accessing it.