VAR-200806-0345
Vulnerability from variot - Updated: 2025-04-10 23:15Cross-site scripting (XSS) vulnerability in the embedded web server in Xerox 4110, 4590, and 4595 Copier/Printers allows remote attackers to inject arbitrary web script or HTML via unknown attack vectors. The webserver in multiple Xerox copier/printer models is prone to an unspecified HTML-injection vulnerability because it fails to properly sanitize user-supplied input. Attacker-supplied HTML and script code would execute in the context of the affected site, potentially allowing the attacker to steal cookie-based authentication credentials or to control how the site is rendered to the user; other attacks are also possible. The following Xerox copier/printer models are affected: Xerox 4110 Xerox 4590 Xerox 4595. ----------------------------------------------------------------------
Want a new job?
http://secunia.com/secunia_security_specialist/ http://secunia.com/hardcore_disassembler_and_reverse_engineer/
International Partner Manager - Project Sales in the IT-Security Industry: http://corporate.secunia.com/about_secunia/64/
TITLE: Xerox Copier/Printer Products Web Server Unspecified Script Insertion
SECUNIA ADVISORY ID: SA30639
VERIFY ADVISORY: http://secunia.com/advisories/30639/
CRITICAL: Less critical
IMPACT: Cross Site Scripting
WHERE:
From local network
OPERATING SYSTEM: Xerox 4110 Copier/Printer http://secunia.com/product/19057/ Xerox 4590 Copier/Printer http://secunia.com/product/19056/ Xerox 4595 Copier/Printer http://secunia.com/product/19058/
DESCRIPTION: A vulnerability has been reported in some Xerox Copier/Printer products, which can be exploited by malicious people to conduct script insertion attacks.
Certain unspecified input in the Web Server is not properly sanitised before being used.
The vulnerability affects the following products: * Xerox 4110 Copier/Printer * Xerox 4590 Copier/Printer * Xerox 4595 Copier/Printer
SOLUTION: Apply updates (see vendor's advisory for details).
PROVIDED AND/OR DISCOVERED BY: The vendor credits Louhi Networks.
ORIGINAL ADVISORY: XRX08-007: http://www.xerox.com/downloads/usa/en/c/cert_XRX08_007.pdf
About: This Advisory was delivered by Secunia as a free service to help everybody keeping their systems up to date against the latest vulnerabilities.
Subscribe: http://secunia.com/secunia_security_advisories/
Definitions: (Criticality, Where etc.) http://secunia.com/about_secunia_advisories/
Please Note: Secunia recommends that you verify all advisories you receive by clicking the link. Secunia NEVER sends attached files with advisories. Secunia does not advise people to install third party patches, only use those supplied by the vendor.
Unsubscribe: Secunia Security Advisories http://secunia.com/sec_adv_unsubscribe/?email=packet%40packetstormsecurity.org
Show details on source website
{
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/VARIoTentry#",
"affected_products": {
"@id": "https://www.variotdbs.pl/ref/affected_products"
},
"configurations": {
"@id": "https://www.variotdbs.pl/ref/configurations"
},
"credits": {
"@id": "https://www.variotdbs.pl/ref/credits"
},
"cvss": {
"@id": "https://www.variotdbs.pl/ref/cvss/"
},
"description": {
"@id": "https://www.variotdbs.pl/ref/description/"
},
"exploit_availability": {
"@id": "https://www.variotdbs.pl/ref/exploit_availability/"
},
"external_ids": {
"@id": "https://www.variotdbs.pl/ref/external_ids/"
},
"iot": {
"@id": "https://www.variotdbs.pl/ref/iot/"
},
"iot_taxonomy": {
"@id": "https://www.variotdbs.pl/ref/iot_taxonomy/"
},
"patch": {
"@id": "https://www.variotdbs.pl/ref/patch/"
},
"problemtype_data": {
"@id": "https://www.variotdbs.pl/ref/problemtype_data/"
},
"references": {
"@id": "https://www.variotdbs.pl/ref/references/"
},
"sources": {
"@id": "https://www.variotdbs.pl/ref/sources/"
},
"sources_release_date": {
"@id": "https://www.variotdbs.pl/ref/sources_release_date/"
},
"sources_update_date": {
"@id": "https://www.variotdbs.pl/ref/sources_update_date/"
},
"threat_type": {
"@id": "https://www.variotdbs.pl/ref/threat_type/"
},
"title": {
"@id": "https://www.variotdbs.pl/ref/title/"
},
"type": {
"@id": "https://www.variotdbs.pl/ref/type/"
}
},
"@id": "https://www.variotdbs.pl/vuln/VAR-200806-0345",
"affected_products": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/affected_products#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
},
"@id": "https://www.variotdbs.pl/ref/sources"
}
},
"data": [
{
"model": "4110",
"scope": null,
"trust": 1.4,
"vendor": "xerox",
"version": null
},
{
"model": "4590",
"scope": null,
"trust": 1.4,
"vendor": "xerox",
"version": null
},
{
"model": "4595",
"scope": null,
"trust": 1.4,
"vendor": "xerox",
"version": null
},
{
"model": "4595",
"scope": "eq",
"trust": 1.0,
"vendor": "xerox",
"version": "*"
},
{
"model": "4110",
"scope": "eq",
"trust": 1.0,
"vendor": "xerox",
"version": "*"
},
{
"model": "4590",
"scope": "eq",
"trust": 1.0,
"vendor": "xerox",
"version": "*"
},
{
"model": "copier/printer",
"scope": "eq",
"trust": 0.3,
"vendor": "xerox",
"version": "45950"
},
{
"model": "copier/printer",
"scope": "eq",
"trust": 0.3,
"vendor": "xerox",
"version": "45900"
},
{
"model": "copier/printer",
"scope": "eq",
"trust": 0.3,
"vendor": "xerox",
"version": "41100"
}
],
"sources": [
{
"db": "BID",
"id": "29690"
},
{
"db": "JVNDB",
"id": "JVNDB-2008-005894"
},
{
"db": "CNNVD",
"id": "CNNVD-200806-239"
},
{
"db": "NVD",
"id": "CVE-2008-2743"
}
]
},
"configurations": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/configurations#",
"children": {
"@container": "@list"
},
"cpe_match": {
"@container": "@list"
},
"data": {
"@container": "@list"
},
"nodes": {
"@container": "@list"
}
},
"data": [
{
"CVE_data_version": "4.0",
"nodes": [
{
"cpe_match": [
{
"cpe22Uri": "cpe:/h:xerox:xerox_4110",
"vulnerable": true
},
{
"cpe22Uri": "cpe:/h:xerox:xerox_4590",
"vulnerable": true
},
{
"cpe22Uri": "cpe:/h:xerox:xerox_4595",
"vulnerable": true
}
],
"operator": "OR"
}
]
}
],
"sources": [
{
"db": "JVNDB",
"id": "JVNDB-2008-005894"
}
]
},
"credits": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/credits#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "Finland\u0027s Louhi Networks",
"sources": [
{
"db": "BID",
"id": "29690"
},
{
"db": "CNNVD",
"id": "CNNVD-200806-239"
}
],
"trust": 0.9
},
"cve": "CVE-2008-2743",
"cvss": {
"@context": {
"cvssV2": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/cvss/cvssV2#"
},
"@id": "https://www.variotdbs.pl/ref/cvss/cvssV2"
},
"cvssV3": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/cvss/cvssV3#"
},
"@id": "https://www.variotdbs.pl/ref/cvss/cvssV3/"
},
"severity": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/cvss/severity#"
},
"@id": "https://www.variotdbs.pl/ref/cvss/severity"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
},
"@id": "https://www.variotdbs.pl/ref/sources"
}
},
"data": [
{
"cvssV2": [
{
"accessComplexity": "MEDIUM",
"accessVector": "NETWORK",
"authentication": "NONE",
"author": "nvd@nist.gov",
"availabilityImpact": "NONE",
"baseScore": 4.3,
"confidentialityImpact": "NONE",
"exploitabilityScore": 8.6,
"id": "CVE-2008-2743",
"impactScore": 2.9,
"integrityImpact": "PARTIAL",
"severity": "MEDIUM",
"trust": 1.8,
"vectorString": "AV:N/AC:M/Au:N/C:N/I:P/A:N",
"version": "2.0"
}
],
"cvssV3": [],
"severity": [
{
"author": "nvd@nist.gov",
"id": "CVE-2008-2743",
"trust": 1.0,
"value": "MEDIUM"
},
{
"author": "NVD",
"id": "CVE-2008-2743",
"trust": 0.8,
"value": "Medium"
},
{
"author": "CNNVD",
"id": "CNNVD-200806-239",
"trust": 0.6,
"value": "MEDIUM"
}
]
}
],
"sources": [
{
"db": "JVNDB",
"id": "JVNDB-2008-005894"
},
{
"db": "CNNVD",
"id": "CNNVD-200806-239"
},
{
"db": "NVD",
"id": "CVE-2008-2743"
}
]
},
"description": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/description#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "Cross-site scripting (XSS) vulnerability in the embedded web server in Xerox 4110, 4590, and 4595 Copier/Printers allows remote attackers to inject arbitrary web script or HTML via unknown attack vectors. The webserver in multiple Xerox copier/printer models is prone to an unspecified HTML-injection vulnerability because it fails to properly sanitize user-supplied input. \nAttacker-supplied HTML and script code would execute in the context of the affected site, potentially allowing the attacker to steal cookie-based authentication credentials or to control how the site is rendered to the user; other attacks are also possible. \nThe following Xerox copier/printer models are affected:\nXerox 4110\nXerox 4590\nXerox 4595. ----------------------------------------------------------------------\n\nWant a new job?\n\nhttp://secunia.com/secunia_security_specialist/\nhttp://secunia.com/hardcore_disassembler_and_reverse_engineer/\n\nInternational Partner Manager - Project Sales in the IT-Security\nIndustry:\nhttp://corporate.secunia.com/about_secunia/64/\n\n----------------------------------------------------------------------\n\nTITLE:\nXerox Copier/Printer Products Web Server Unspecified Script Insertion\n\nSECUNIA ADVISORY ID:\nSA30639\n\nVERIFY ADVISORY:\nhttp://secunia.com/advisories/30639/\n\nCRITICAL:\nLess critical\n\nIMPACT:\nCross Site Scripting\n\nWHERE:\n\u003eFrom local network\n\nOPERATING SYSTEM:\nXerox 4110 Copier/Printer\nhttp://secunia.com/product/19057/\nXerox 4590 Copier/Printer\nhttp://secunia.com/product/19056/\nXerox 4595 Copier/Printer\nhttp://secunia.com/product/19058/\n\nDESCRIPTION:\nA vulnerability has been reported in some Xerox Copier/Printer\nproducts, which can be exploited by malicious people to conduct\nscript insertion attacks. \n\nCertain unspecified input in the Web Server is not properly sanitised\nbefore being used. \n\nThe vulnerability affects the following products:\n* Xerox 4110 Copier/Printer\n* Xerox 4590 Copier/Printer\n* Xerox 4595 Copier/Printer\n\nSOLUTION:\nApply updates (see vendor\u0027s advisory for details). \n\nPROVIDED AND/OR DISCOVERED BY:\nThe vendor credits Louhi Networks. \n\nORIGINAL ADVISORY:\nXRX08-007:\nhttp://www.xerox.com/downloads/usa/en/c/cert_XRX08_007.pdf\n\n----------------------------------------------------------------------\n\nAbout:\nThis Advisory was delivered by Secunia as a free service to help\neverybody keeping their systems up to date against the latest\nvulnerabilities. \n\nSubscribe:\nhttp://secunia.com/secunia_security_advisories/\n\nDefinitions: (Criticality, Where etc.)\nhttp://secunia.com/about_secunia_advisories/\n\n\nPlease Note:\nSecunia recommends that you verify all advisories you receive by\nclicking the link. \nSecunia NEVER sends attached files with advisories. \nSecunia does not advise people to install third party patches, only\nuse those supplied by the vendor. \n\n----------------------------------------------------------------------\n\nUnsubscribe: Secunia Security Advisories\nhttp://secunia.com/sec_adv_unsubscribe/?email=packet%40packetstormsecurity.org\n\n----------------------------------------------------------------------\n\n\n",
"sources": [
{
"db": "NVD",
"id": "CVE-2008-2743"
},
{
"db": "JVNDB",
"id": "JVNDB-2008-005894"
},
{
"db": "BID",
"id": "29690"
},
{
"db": "PACKETSTORM",
"id": "67284"
}
],
"trust": 1.98
},
"external_ids": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/external_ids#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"db": "NVD",
"id": "CVE-2008-2743",
"trust": 2.7
},
{
"db": "BID",
"id": "29690",
"trust": 1.9
},
{
"db": "SECUNIA",
"id": "30639",
"trust": 1.7
},
{
"db": "SECTRACK",
"id": "1020282",
"trust": 1.6
},
{
"db": "VUPEN",
"id": "ADV-2008-1829",
"trust": 1.6
},
{
"db": "JVNDB",
"id": "JVNDB-2008-005894",
"trust": 0.8
},
{
"db": "XF",
"id": "43058",
"trust": 0.6
},
{
"db": "CNNVD",
"id": "CNNVD-200806-239",
"trust": 0.6
},
{
"db": "PACKETSTORM",
"id": "67284",
"trust": 0.1
}
],
"sources": [
{
"db": "BID",
"id": "29690"
},
{
"db": "JVNDB",
"id": "JVNDB-2008-005894"
},
{
"db": "PACKETSTORM",
"id": "67284"
},
{
"db": "CNNVD",
"id": "CNNVD-200806-239"
},
{
"db": "NVD",
"id": "CVE-2008-2743"
}
]
},
"id": "VAR-200806-0345",
"iot": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/iot#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": true,
"sources": [
{
"db": "VARIoT devices database",
"id": null
}
],
"trust": 0.41666666
},
"last_update_date": "2025-04-10T23:15:43.090000Z",
"patch": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/patch#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"title": "Xerox Security Bulletin XRX08-007",
"trust": 0.8,
"url": "http://www.xerox.com/downloads/usa/en/c/cert_XRX08_007.pdf"
}
],
"sources": [
{
"db": "JVNDB",
"id": "JVNDB-2008-005894"
}
]
},
"problemtype_data": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/problemtype_data#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"problemtype": "CWE-79",
"trust": 1.8
}
],
"sources": [
{
"db": "JVNDB",
"id": "JVNDB-2008-005894"
},
{
"db": "NVD",
"id": "CVE-2008-2743"
}
]
},
"references": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/references#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"trust": 2.0,
"url": "http://www.xerox.com/downloads/usa/en/c/cert_xrx08_007.pdf"
},
{
"trust": 1.6,
"url": "http://www.securitytracker.com/id?1020282"
},
{
"trust": 1.6,
"url": "http://www.securityfocus.com/bid/29690"
},
{
"trust": 1.6,
"url": "http://secunia.com/advisories/30639"
},
{
"trust": 1.0,
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/43058"
},
{
"trust": 1.0,
"url": "http://www.vupen.com/english/advisories/2008/1829/references"
},
{
"trust": 0.8,
"url": "http://cve.mitre.org/cgi-bin/cvename.cgi?name=cve-2008-2743"
},
{
"trust": 0.8,
"url": "http://web.nvd.nist.gov/view/vuln/detail?vulnid=cve-2008-2743"
},
{
"trust": 0.6,
"url": "http://xforce.iss.net/xforce/xfdb/43058"
},
{
"trust": 0.6,
"url": "http://www.frsirt.com/english/advisories/2008/1829/references"
},
{
"trust": 0.3,
"url": "http://www.xerox.com"
},
{
"trust": 0.1,
"url": "http://secunia.com/secunia_security_advisories/"
},
{
"trust": 0.1,
"url": "http://secunia.com/product/19058/"
},
{
"trust": 0.1,
"url": "http://secunia.com/product/19056/"
},
{
"trust": 0.1,
"url": "http://secunia.com/advisories/30639/"
},
{
"trust": 0.1,
"url": "http://secunia.com/product/19057/"
},
{
"trust": 0.1,
"url": "http://secunia.com/hardcore_disassembler_and_reverse_engineer/"
},
{
"trust": 0.1,
"url": "http://secunia.com/sec_adv_unsubscribe/?email=packet%40packetstormsecurity.org"
},
{
"trust": 0.1,
"url": "http://secunia.com/secunia_security_specialist/"
},
{
"trust": 0.1,
"url": "http://corporate.secunia.com/about_secunia/64/"
},
{
"trust": 0.1,
"url": "http://secunia.com/about_secunia_advisories/"
}
],
"sources": [
{
"db": "BID",
"id": "29690"
},
{
"db": "JVNDB",
"id": "JVNDB-2008-005894"
},
{
"db": "PACKETSTORM",
"id": "67284"
},
{
"db": "CNNVD",
"id": "CNNVD-200806-239"
},
{
"db": "NVD",
"id": "CVE-2008-2743"
}
]
},
"sources": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#",
"data": {
"@container": "@list"
}
},
"data": [
{
"db": "BID",
"id": "29690"
},
{
"db": "JVNDB",
"id": "JVNDB-2008-005894"
},
{
"db": "PACKETSTORM",
"id": "67284"
},
{
"db": "CNNVD",
"id": "CNNVD-200806-239"
},
{
"db": "NVD",
"id": "CVE-2008-2743"
}
]
},
"sources_release_date": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources_release_date#",
"data": {
"@container": "@list"
}
},
"data": [
{
"date": "2008-06-12T00:00:00",
"db": "BID",
"id": "29690"
},
{
"date": "2012-12-20T00:00:00",
"db": "JVNDB",
"id": "JVNDB-2008-005894"
},
{
"date": "2008-06-13T16:33:08",
"db": "PACKETSTORM",
"id": "67284"
},
{
"date": "2008-06-17T00:00:00",
"db": "CNNVD",
"id": "CNNVD-200806-239"
},
{
"date": "2008-06-17T15:41:00",
"db": "NVD",
"id": "CVE-2008-2743"
}
]
},
"sources_update_date": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources_update_date#",
"data": {
"@container": "@list"
}
},
"data": [
{
"date": "2015-05-07T17:28:00",
"db": "BID",
"id": "29690"
},
{
"date": "2012-12-20T00:00:00",
"db": "JVNDB",
"id": "JVNDB-2008-005894"
},
{
"date": "2009-04-14T00:00:00",
"db": "CNNVD",
"id": "CNNVD-200806-239"
},
{
"date": "2025-04-09T00:30:58.490000",
"db": "NVD",
"id": "CVE-2008-2743"
}
]
},
"threat_type": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/threat_type#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "remote",
"sources": [
{
"db": "CNNVD",
"id": "CNNVD-200806-239"
}
],
"trust": 0.6
},
"title": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/title#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "Xerox 4110 Such as Copier/Printers Embedding Web Server cross-site scripting vulnerability",
"sources": [
{
"db": "JVNDB",
"id": "JVNDB-2008-005894"
}
],
"trust": 0.8
},
"type": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/type#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "XSS",
"sources": [
{
"db": "CNNVD",
"id": "CNNVD-200806-239"
}
],
"trust": 0.6
}
}
Loading…
Loading…
Experimental. This forecast is provided for visualization only and may change without notice. Do not use it for operational decisions.
Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.
Sightings
| Author | Source | Type | Date | Other |
|---|
Nomenclature
- Seen: The vulnerability was mentioned, discussed, or observed by the user.
- Confirmed: The vulnerability has been validated from an analyst's perspective.
- Published Proof of Concept: A public proof of concept is available for this vulnerability.
- Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
- Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
- Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
- Not confirmed: The user expressed doubt about the validity of the vulnerability.
- Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.
Loading…
Loading…