Every CVE Search/ Get API key

CVE-2009-2820

The web interface in CUPS before 1.4.2, as used on Apple Mac OS X before 10.6.2 and other...

4.3 MediumPublic exploitFix available

The web interface in CUPS before 1.4.2, as used on Apple Mac OS X before 10.6.2 and other platforms, does not properly handle (1) HTTP headers and (2) HTML templates, which allows remote attackers to conduct cross-site scripting (XSS) attacks and HTTP response splitting attacks via vectors related to (a) the product's web interface, (b) the configuration of the print system, and (c) the titles of printed jobs, as demonstrated by an XSS attack that uses the kerberos parameter to the admin program, and leverages attribute injection and HTTP Parameter Pollution (HPP) issues.

Exploit likelihood

5.78%Down 6.5 points since Feb 4, 2022
90%50%10%1%

What each source reports

NVD Score used 4.3

The web interface in CUPS before 1.4.2, as used on Apple Mac OS X before 10.6.2 and other platforms, does not properly handle (1) HTTP headers and (2) HTML templates, which allows remote attackers to conduct cross-site scripting (XSS) attacks and HTTP response splitting attacks via vectors related to (a) the product's web interface, (b) the configuration of the print system, and (c) the titles of printed jobs, as demonstrated by an XSS attack that uses the kerberos parameter to the admin program, and leverages attribute injection and HTTP Parameter Pollution (HPP) issues.

Record
CVE-2009-2820
CVSS 2.0
4.3 MediumAV:N/AC:M/Au:N/C:N/I:P/A:N
Weakness
CWE-79
Updated
2026-11-02
CVE List No score

The web interface in CUPS before 1.4.2, as used on Apple Mac OS X before 10.6.2 and other platforms, does not properly handle (1) HTTP headers and (2) HTML templates, which allows remote attackers to conduct cross-site scripting (XSS) attacks and HTTP response splitting attacks via vectors related to (a) the product's web interface, (b) the configuration of the print system, and (c) the titles of printed jobs, as demonstrated by an XSS attack that uses the kerberos parameter to the admin program, and leverages attribute injection and HTTP Parameter Pollution (HPP) issues.

Record
CVE-2009-2820
Updated
2026-11-02
EUVDEUVD-2009-2810 No score

The web interface in CUPS before 1.4.2, as used on Apple Mac OS X before 10.6.2 and other platforms, does not properly handle (1) HTTP headers and (2) HTML templates, which allows remote attackers to conduct cross-site scripting (XSS) attacks and HTTP response splitting attacks via vectors related to (a) the product's web interface, (b) the configuration of the print system, and (c) the titles of printed jobs, as demonstrated by an XSS attack that uses the kerberos parameter to the admin program, and leverages attribute injection and HTTP Parameter Pollution (HPP) issues.

Record
EUVD-2009-2810
Updated
2026-11-03
GitHub AdvisoriesGHSA-hmf5-7mhf-fpjh No score

The web interface in CUPS before 1.4.2, as used on Apple Mac OS X before 10.6.2 and other...

The web interface in CUPS before 1.4.2, as used on Apple Mac OS X before 10.6.2 and other platforms, does not properly handle (1) HTTP headers and (2) HTML templates, which allows remote attackers to conduct cross-site scripting (XSS) attacks and HTTP response splitting attacks via vectors related to (a) the product's web interface, (b) the configuration of the print system, and (c) the titles of printed jobs, as demonstrated by an XSS attack that uses the kerberos parameter to the admin program, and leverages attribute injection and HTTP Parameter Pollution (HPP) issues.

Record
GHSA-hmf5-7mhf-fpjh
Weakness
CWE-79
Updated
2026-11-02
OSV No score

The web interface in CUPS before 1.4.2, as used on Apple Mac OS X before 10.6.2 and other platforms, does not properly handle (1) HTTP headers and (2) HTML templates, which allows remote attackers to conduct cross-site scripting (XSS) attacks and HTTP response splitting attacks via vectors related to (a) the product's web interface, (b) the configuration of the print system, and (c) the titles of printed jobs, as demonstrated by an XSS attack that uses the kerberos parameter to the admin program, and leverages attribute injection and HTTP Parameter Pollution (HPP) issues.

Record
CVE-2009-2820
Updated
2026-11-02
OSVDEBIAN-CVE-2009-2820 No score

The web interface in CUPS before 1.4.2, as used on Apple Mac OS X before 10.6.2 and other platforms, does not properly handle (1) HTTP headers and (2) HTML templates, which allows remote attackers to conduct cross-site scripting (XSS) attacks and HTTP response splitting attacks via vectors related to (a) the product's web interface, (b) the configuration of the print system, and (c) the titles of printed jobs, as demonstrated by an XSS attack that uses the kerberos parameter to the admin program, and leverages attribute injection and HTTP Parameter Pollution (HPP) issues.

Record
DEBIAN-CVE-2009-2820
Updated
2026-11-02
OSVopenSUSE-SU-2024:10075-1 No score

cups-2.1.3-2.3 on GA media

These are all security issues fixed in the cups-2.1.3-2.3 package on the GA media of openSUSE Tumbleweed.

Record
openSUSE-SU-2024:10075-1
Updated
2026-11-02

Affected products

Affected packages

Affected packages
PackageAffectedFixed
cups
Debian:12
 before 1.4.2-1
1.4.2-1
cups
Debian:13
 before 1.4.2-1
1.4.2-1
cups
Debian:14
 before 1.4.2-1
1.4.2-1
cupsys
Debian:4.0
 before 1.2.7-4+etch9, plus listed versions
1.2.7-41.2.7-4+etch81.2.7-4etch11.2.7-4etch21.2.7-4etch3
Show 4 moreShow less
1.2.7-4etch41.2.7-4etch51.2.7-4etch61.2.7-4etch7
1.2.7-4+etch9
cups
Debian:5.0
 before 1.3.8-1+lenny7, plus listed versions
1.3.8-1+lenny61.3.8-1lenny4.11.3.8-1lenny5
1.3.8-1+lenny7
cups
Red Hat:enterprise_linux:5::client_workstation
From an advisory covering 2 CVEs
 before 1:1.3.7-11.el5_4.4
1:1.3.7-11.el5_4.4
cups-debuginfo
Red Hat:enterprise_linux:5::client_workstation
From an advisory covering 2 CVEs
 before 1:1.3.7-11.el5_4.4
1:1.3.7-11.el5_4.4
cups-devel
Red Hat:enterprise_linux:5::client_workstation
From an advisory covering 2 CVEs
 before 1:1.3.7-11.el5_4.4
1:1.3.7-11.el5_4.4
cups
Red Hat:enterprise_linux:5::client
From an advisory covering 2 CVEs
 before 1:1.3.7-11.el5_4.4
1:1.3.7-11.el5_4.4
cups-debuginfo
Red Hat:enterprise_linux:5::client
From an advisory covering 2 CVEs
 before 1:1.3.7-11.el5_4.4
1:1.3.7-11.el5_4.4
Show 8 moreShow less
Affected packages
PackageAffectedFixed
cups-libs
Red Hat:enterprise_linux:5::client
From an advisory covering 2 CVEs
 before 1:1.3.7-11.el5_4.4
1:1.3.7-11.el5_4.4
cups-lpd
Red Hat:enterprise_linux:5::client
From an advisory covering 2 CVEs
 before 1:1.3.7-11.el5_4.4
1:1.3.7-11.el5_4.4
cups
Red Hat:enterprise_linux:5::server
From an advisory covering 2 CVEs
 before 1:1.3.7-11.el5_4.4
1:1.3.7-11.el5_4.4
cups-debuginfo
Red Hat:enterprise_linux:5::server
From an advisory covering 2 CVEs
 before 1:1.3.7-11.el5_4.4
1:1.3.7-11.el5_4.4
cups-devel
Red Hat:enterprise_linux:5::server
From an advisory covering 2 CVEs
 before 1:1.3.7-11.el5_4.4
1:1.3.7-11.el5_4.4
cups-libs
Red Hat:enterprise_linux:5::server
From an advisory covering 2 CVEs
 before 1:1.3.7-11.el5_4.4
1:1.3.7-11.el5_4.4
cups-lpd
Red Hat:enterprise_linux:5::server
From an advisory covering 2 CVEs
 before 1:1.3.7-11.el5_4.4
1:1.3.7-11.el5_4.4
cups
openSUSE:Tumbleweed
From an advisory covering 17 CVEs
 before 2.1.3-2.3
2.1.3-2.3

Public exploits

Links only. Every CVE stores no exploit code.

Public exploits
SourceLinkDate
Exploit-DBCUPS - 'kerberos' Cross-Site Scripting2009-11-11

History

History
RecordedChangedSources
affected, facts
aliasesEUVD
first indexedCVE List, Exploit-DB, GitHub Advisories, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2009-2820 is a medium vulnerability (CVSS 4.3) in Apple Mac Os X, published November 10, 2009. Public exploit code exists. EPSS puts the chance of exploitation in the next 30 days at 5.78%, the 93rd percentile. Fixed in cups 1.4.2-1.

References

Show 38 moreShow less
Pages All vulnerabilities Browse Docs Sources Guide Get API key
MoveEnter Open