This host is installed with CUPS and is prone to cross site scripting vulnerability

Successful exploitation will allow attacker to execute arbitrary HTML and script code in a user's browser session in the context of an affected site. Impact Level: Application

Upgrade to version 1.7.2, or higher, For updates refer to http://www.cups.org/software.php

Flaws is due to is_path_absolute() function does not validate input via URL path before returning it to users.

Common Unix Printing System (CUPS) version before 1.7.2

Send a crafted data via HTTP GET request and check whether it is able to get domain or not.

• http://osvdb.org/105715
• http://secunia.com/advisories/57880/
• http://www.cups.org/str.php?L4356
• http://www.openwall.com/lists/oss-security/2014/04/14/2

---

Updated on 2015-03-25