The default configuration of the PJL Access value in the File System External Access settings on HP LaserJet MFP printers, Color LaserJet MFP printers, and LaserJet 4100, 4200, 4300, 5100, 8150, and 9000 printers enables PJL commands that use the device's filesystem, which allows remote attackers to read arbitrary files via a command inside a print job, as demonstrated by a directory traversal attack.
| Type | CWE ID | Description |
|---|---|---|
| text | N/A | n/a |
| Version | Base score | Base severity | Vector |
|---|
| CAPEC ID | Description |
|---|
| Event | Date |
|---|
| Hyperlink | Resource |
|---|---|
| http://securitytracker.com/id?1024741 | vdb-entry x_refsource_SECTRACK |
| http://www.exploit-db.com/exploits/15631 | exploit x_refsource_EXPLOIT-DB |
| http://securityreason.com/securityalert/8328 | third-party-advisory x_refsource_SREASON |
| http://www.itrc.hp.com/service/cki/docDisplay.do?docId=emr_na-c02004333 | vendor-advisory x_refsource_HP |
| http://www.nruns.com/_downloads/SA-2010%20003-Hewlett-Packard.pdf | x_refsource_MISC |
| http://secunia.com/advisories/42238 | third-party-advisory x_refsource_SECUNIA |
| http://www.vupen.com/english/advisories/2010/2987 | vdb-entry x_refsource_VUPEN |
| http://www.securityfocus.com/bid/44882 | vdb-entry x_refsource_BID |
| http://www.itrc.hp.com/service/cki/docDisplay.do?docId=emr_na-c02004333 | vendor-advisory x_refsource_HP |
| https://exchange.xforce.ibmcloud.com/vulnerabilities/63261 | vdb-entry x_refsource_XF |
| Version | Base score | Base severity | Vector |
|---|
| CAPEC ID | Description |
|---|
| Event | Date |
|---|
| Hyperlink | Resource |
|---|---|
| http://securitytracker.com/id?1024741 | vdb-entry x_refsource_SECTRACK x_transferred |
| http://www.exploit-db.com/exploits/15631 | exploit x_refsource_EXPLOIT-DB x_transferred |
| http://securityreason.com/securityalert/8328 | third-party-advisory x_refsource_SREASON x_transferred |
| http://www.itrc.hp.com/service/cki/docDisplay.do?docId=emr_na-c02004333 | vendor-advisory x_refsource_HP x_transferred |
| http://www.nruns.com/_downloads/SA-2010%20003-Hewlett-Packard.pdf | x_refsource_MISC x_transferred |
| http://secunia.com/advisories/42238 | third-party-advisory x_refsource_SECUNIA x_transferred |
| http://www.vupen.com/english/advisories/2010/2987 | vdb-entry x_refsource_VUPEN x_transferred |
| http://www.securityfocus.com/bid/44882 | vdb-entry x_refsource_BID x_transferred |
| http://www.itrc.hp.com/service/cki/docDisplay.do?docId=emr_na-c02004333 | vendor-advisory x_refsource_HP x_transferred |
| https://exchange.xforce.ibmcloud.com/vulnerabilities/63261 | vdb-entry x_refsource_XF x_transferred |