Vulnerability Description
The default configuration of the PJL Access value in the File System External Access settings on HP LaserJet MFP printers, Color LaserJet MFP printers, and LaserJet 4100, 4200, 4300, 5100, 8150, and 9000 printers enables PJL commands that use the device's filesystem, which allows remote attackers to read arbitrary files via a command inside a print job, as demonstrated by a directory traversal attack.
CVSS Score
HIGH
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Hp | 9000 | All versions |
| Hp | Color Laserjet Mfp | All versions |
| Hp | Laserjet 4100 | All versions |
| Hp | Laserjet 4200 | All versions |
| Hp | Laserjet 4300 | All versions |
| Hp | Laserjet 5100 | All versions |
| Hp | Laserjet 8150 | All versions |
| Hp | Laserjet Mfp | All versions |
Related Weaknesses (CWE)
References
- http://secunia.com/advisories/42238Vendor Advisory
- http://securityreason.com/securityalert/8328
- http://securitytracker.com/id?1024741
- http://www.exploit-db.com/exploits/15631
- http://www.itrc.hp.com/service/cki/docDisplay.do?docId=emr_na-c02004333
- http://www.nruns.com/_downloads/SA-2010%20003-Hewlett-Packard.pdf
- http://www.securityfocus.com/bid/44882
- http://www.vupen.com/english/advisories/2010/2987Vendor Advisory
- https://exchange.xforce.ibmcloud.com/vulnerabilities/63261
- http://secunia.com/advisories/42238Vendor Advisory
- http://securityreason.com/securityalert/8328
- http://securitytracker.com/id?1024741
- http://www.exploit-db.com/exploits/15631
- http://www.itrc.hp.com/service/cki/docDisplay.do?docId=emr_na-c02004333
- http://www.nruns.com/_downloads/SA-2010%20003-Hewlett-Packard.pdf
FAQ
What is CVE-2010-4107?
CVE-2010-4107 is a vulnerability with a CVSS score of 7.8 (HIGH). The default configuration of the PJL Access value in the File System External Access settings on HP LaserJet MFP printers, Color LaserJet MFP printers, and LaserJet 4100, 4200, 4300, 5100, 8150, and 9...
How severe is CVE-2010-4107?
CVE-2010-4107 has been rated HIGH with a CVSS base score of 7.8/10. Review the CVSS metrics above for detailed severity breakdown.
Is there a patch for CVE-2010-4107?
Check the references section above for vendor advisories and patch information. Affected products include: Hp 9000, Hp Color Laserjet Mfp, Hp Laserjet 4100, Hp Laserjet 4200, Hp Laserjet 4300.