OSVDB ID: 78224

Title: HP LaserJet P3015 Embedded Web Server Traversal Arbitrary File Access

Info

Disclosure

Jan 10, 2012

Discovery

Unknown

Dates

Exploit

Unknown

Solution

Jan 09, 2012

Description

HP LaserJet P3015 contains a flaw that allows a remote attacker to traverse outside of a restricted path. The issue is due to the embedded web server not properly sanitizing user input, specifically directory traversal style attacks (e.g., ../../). This directory traversal attack would allow the attacker to read arbitrary files.

Classification

Location: Remote / Network Access
Impact: Loss of Confidentiality
Solution: Upgrade
Exploit: Exploit Public
Disclosure: Vendor Verified
OSVDB: Web Related

Solution

Upgrade to version 07.080.3 or higher, as it has been reported to fix this vulnerability. An upgrade is required as there are no known workarounds.

Products

Hewlett-Packard Development Company, L.P.

HP LaserJet P3015

Firmware 20100518 07.050.8

References

Credit

Unknown or Incomplete



Direct URL: http://osvdb.org/78224