CVE-2017-14386

The web user interface of Dell 2335dn and 2355dn Multifunction Laser Printers, firmware versions prior to V2.70.06.26 A13 and V2.70.45.34 A10 respectively, are affected by a cross-site scripting vulnerability. Attackers could potentially exploit this vulnerability to execute arbitrary HTML or JavaScript code in the user's browser session in the context of the affected website.

CVSS v3 6.1 MEDIUM
CVSS v2.0 4.3 MEDIUM

6.1^/10

CVSS v3 : MEDIUM

Vector : AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Exploitability : 2.8 / Impact : 2.7

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction REQUIRED

Confidentiality Impact LOW

Integrity Impact LOW

Availability Impact NONE

Scope CHANGED

4.3^/10

CVSS v2.0 : MEDIUM

Vector : AV:N/AC:M/Au:N/C:N/I:P/A:N

Exploitability : 8.6 / Impact : 2.9

Access Vector NETWORK

Access Complexity MEDIUM

Authentication NONE

Confidentiality Impact NONE

Integrity Impact PARTIAL

Availability Impact NONE

References

Link	Resource
http://www.dell.com/support/home/us/en/19/drivers/driversdetails?driverId=782W3	Patch Vendor Advisory
http://www.dell.com/support/home/us/en/19/drivers/driversdetails?driverId=CG55V	Patch Vendor Advisory

Configurations

Configuration 1 (hide)

AND

cpe:2.3:o:dell:2355dn_firmware:*:*:*:*:*:*:*:*

cpe:2.3:h:dell:2355dn:-:*:*:*:*:*:*:*

Configuration 2 (hide)

AND

cpe:2.3:o:dell:2335dn_firmware:*:*:*:*:*:*:*:*

cpe:2.3:h:dell:2335dn:-:*:*:*:*:*:*:*

History

No history.

Information

Published : 2017-12-07 19:29

Updated : 2024-02-28 16:04

NVD link : CVE-2017-14386

Mitre link : CVE-2017-14386

CVE.ORG link : CVE-2017-14386

JSON object : View

Products Affected

dell

2335dn_firmware
2355dn_firmware
2335dn
2355dn

CWE

CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

{"id": "CVE-2017-14386", "metrics": {"cvssMetricV2": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"version": "2.0", "baseScore": 4.3, "accessVector": "NETWORK", "vectorString": "AV:N/AC:M/Au:N/C:N/I:P/A:N", "authentication": "NONE", "integrityImpact": "PARTIAL", "accessComplexity": "MEDIUM", "availabilityImpact": "NONE", "confidentialityImpact": "NONE"}, "acInsufInfo": false, "impactScore": 2.9, "baseSeverity": "MEDIUM", "obtainAllPrivilege": false, "exploitabilityScore": 8.6, "obtainUserPrivilege": false, "obtainOtherPrivilege": false, "userInteractionRequired": true}], "cvssMetricV30": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "CHANGED", "version": "3.0", "baseScore": 6.1, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N", "integrityImpact": "LOW", "userInteraction": "REQUIRED", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "LOW"}, "impactScore": 2.7, "exploitabilityScore": 2.8}]}, "published": "2017-12-07T19:29:00.257", "references": [{"url": "http://www.dell.com/support/home/us/en/19/drivers/driversdetails?driverId=782W3", "tags": ["Patch", "Vendor Advisory"], "source": "security_alert@emc.com"}, {"url": "http://www.dell.com/support/home/us/en/19/drivers/driversdetails?driverId=CG55V", "tags": ["Patch", "Vendor Advisory"], "source": "security_alert@emc.com"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "CWE-79"}]}], "descriptions": [{"lang": "en", "value": "The web user interface of Dell 2335dn and 2355dn Multifunction Laser Printers, firmware versions prior to V2.70.06.26 A13 and V2.70.45.34 A10 respectively, are affected by a cross-site scripting vulnerability. Attackers could potentially exploit this vulnerability to execute arbitrary HTML or JavaScript code in the user's browser session in the context of the affected website."}, {"lang": "es", "value": "La interfaz de usuario web de las impresoras l\u00e1ser multifunci\u00f3n Dell 2335dn y 2355dn, con versiones de firmware anteriores a la V2.70.06.26 A13 y a la V2.70.45.34 A10 respectivamente, se ven afectadas por una vulnerabilidad de Cross-Site Scripting (XSS). Los atacantes podr\u00edan explotar esta vulnerabilidad para ejecutar HTML o c\u00f3digo JavaScript arbitrarios en la sesi\u00f3n del buscador del usuario, en el contexto de la p\u00e1gina web afectada."}], "lastModified": "2017-12-27T16:12:19.847", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:o:dell:2355dn_firmware:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "D667F590-F2E9-49BD-8B4F-78D794DFA3A0", "versionEndExcluding": "2.70.45.34_a10"}], "operator": "OR"}, {"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:h:dell:2355dn:-:*:*:*:*:*:*:*", "vulnerable": false, "matchCriteriaId": "D3CDAD04-B6C6-421B-8E81-622DE5F9C55D"}], "operator": "OR"}], "operator": "AND"}, {"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:o:dell:2335dn_firmware:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "3295BA2E-32B7-4054-A3DB-DF69BF8DFDAE", "versionEndExcluding": "2.70.06.26_a13"}], "operator": "OR"}, {"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:h:dell:2335dn:-:*:*:*:*:*:*:*", "vulnerable": false, "matchCriteriaId": "E5F3DDB0-4163-4D43-909A-21852E71ECFC"}], "operator": "OR"}], "operator": "AND"}], "sourceIdentifier": "security_alert@emc.com"}