U radu programskog paketa HP Web Jetadmin uočen je sigurnosni propust koji udaljenim napadačima omogućuje umetanje proizvoljne web skripte ili HTML koda.

SUPPORT COMMUNICATION - SECURITY BULLETIN

Document ID: c03331603

Version: 1
HPSBPI02779 SSRT100855 rev.1 - HP Web Jetadmin v8.x Running on Windows, Remote Cross Site Scripting (XSS)
NOTICE: The information in this Security Bulletin should be acted upon as soon as possible.

Release Date: 2012-05-31

Last Updated: 2012-05-31

Potential Security Impact: Remote cross site scripting (XSS)

Source: Hewlett-Packard Company, HP Software Security Response Team
VULNERABILITY SUMMARY

Potential security vulnerabilities have been identified with HP Web Jetadmin v8.x. These vulnerabilities could be exploited remotely resulting in cross site scripting (XSS).

References: CVE-2012-2011
SUPPORTED SOFTWARE VERSIONS*: ONLY impacted versions are listed.

HP Web Jetadmin v8.x
BACKGROUND

For a PGP signed version of this security bulletin please write to: Ova e-mail adresa je zaštićena od spambota. Potrebno je omogućiti JavaScript da je vidite.
CVSS 2.0 Base Metrics
Reference
	
Base Vector
	
Base Score
CVE-2012-2011
	
(AV:N/AC:M/Au:N/C:N/I:P/A:N)
	
4.3

Information on CVSS is documented in HP Customer Notice: HPSN-2008-002

The Hewlett-Packard Company thanks Andrei Costin for reporting these vulnerabilities to Ova e-mail adresa je zaštićena od spambota. Potrebno je omogućiti JavaScript da je vidite..
RESOLUTION

HP has provided HP Web Jetadmin v10.x or subsequent to resolve these vulnerabilities. HP Web Jetadmin v10.x is dated 24 Nov 2009 or later.

HP Web Jetadmin is available for download here: http://h20000.www2.hp.com/bizsupport/TechSupport/DriverDownload.jsp?pnameOID=13039

Note: HP Web Jetadmin v8.x is obsolete and will not be updated. Customers running HP Web Jetadmin v8.x should update to v10.x or subsequent.

HISTORY
Version:1 (rev.1) - 31 May 2012 Initial release