HP Managed Printing Administration < 2.6.4 Multiple Vulnerabilities

high Nessus Plugin ID 57700

Language:

Synopsis

The remote web server hosts an ASP application that is affected by multiple vulnerabilities.

Description

The remote web server is hosting a version of HP Managed Printing Administration earlier than 2.6.4. As such, it is potentially affected by the following vulnerabilities :

- Multiple directory traversal, arbitrary file-deletion, and file-creation vulnerabilities affect the 'MPAUploader.Uploader.1.UploadFiles()' function.
(CVE-2011-4166)

- A remote-code execution vulnerability affects the 'MPAUploader.dll' file which can be exploited via the 'filename' parameter of the 'Default.asp' script.
(CVE-2011-4167)

- Multiple directory traversal, arbitrary file-deletion, and file-creation vulnerabilities affect the '/hpmpa/jobDelivery/Default.asp' script.
(CVE-2011-4168)

- Input via the 'img_id' parameter of the 'imglist\imgselect\Default.asp', 'imgmap\bgselect\Default.asp', and 'imgmpa\imgselect\Default.asp' scripts can be manipulated to perform SQL injection.
(CVE-2011-4169)

Solution

Upgrade to HP Managed Printing Administration 2.6.4 or later.

Plugin Details

Severity: High

ID: 57700

File Name: hp_managed_printing_administration_264.nasl

Version: 1.13

Type: remote

Family: CGI abuses

Published: 1/26/2012

Updated: 1/19/2021

Supported Sensors: Nessus

Risk Information

VPR

Risk Factor: High

Score: 7.3

CVSS v2

Risk Factor: High

Base Score: 9

Temporal Score: 7.4

Vector: CVSS2#AV:N/AC:L/Au:N/C:P/I:P/A:C

Vulnerability Information

CPE: cpe:/a:hp:managed_printing_administration

Required KB Items: www/hp_managed_printing_administration

Excluded KB Items: Settings/disable_cgi_scanning

Exploit Available: true

Exploit Ease: Exploits are available

Patch Publication Date: 12/21/2011

Vulnerability Publication Date: 12/21/2011

Exploitable With

Metasploit (HP Managed Printing Administration jobAcct Remote Command Execution)

ExploitHub (EH-11-073)

Reference Information

CVE: CVE-2011-4166, CVE-2011-4167, CVE-2011-4168, CVE-2011-4169

BID: 51174

Detections

Analytics