← Back

CVE-2021-20877

nvd nist
Published: Feb 8, 2022Modified: Nov 21, 2024

JSON object

Loading...
4.8
Vector
CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N
Exploitability: 1.7 / Impact: 2.7
Source: NVD

Description

Cross-site scripting vulnerability in Canon laser printers and small office multifunctional printers (LBP162L/LBP162, MF4890dw, MF269dw/MF265dw/MF264dw/MF262dw, MF249dw/MF245dw/MF244dw/MF242dw/MF232w, and MF229dw/MF224dw/MF222dw sold in Japan, imageCLASS MF Series (MF113W/MF212W/MF217W/MF227DW/MF229DW, MF232W/MF244DW/MF247DW/MF249DW, MF264DW/MF267DW/MF269DW/MF269DW VP, and MF4570DN/MF4570DW/MF4770N/MF4880DW/MF4890DW) and imageCLASS LBP Series (LBP113W/LBP151DW/LBP162DW ) sold in the US, and iSENSYS (LBP162DW, LBP113W, LBP151DW, MF269dw, MF267dw, MF264dw, MF113w, MF249dw, MF247dw, MF244dw, MF237w, MF232w, MF229dw, MF217w, MF212w, MF4780w, and MF4890dw) and imageRUNNER (2206IF, 2204N, and 2204F) sold in Europe) allows remote attackers to inject an arbitrary script via unspecified vectors.

Affected (34)

Canon
34 products
2204f
2204n
2206if
Lbp113w
Lbp151dw
Lbp162
Lbp162dw
Lbp162l
Mf113w
Mf212w
Mf217w
Mf222dw
Mf224dw
Mf227dw
Mf229dw
Mf232w
Mf237w
Mf242dw
Mf244dw
Mf245dw
Mf247dw
Mf249dw
Mf262dw
Mf264dw
Mf265dw
Mf267dw
Mf269dw
Mf269dw Vp
Mf4570dn
Mf4570dw
Mf4770n
Mf4780w
Mf4880dw
Mf4890dw
Configuration A
34 vulnerable
Vulnerable SoftwareAffected Versions
2204f
All versions
2204n
All versions
2206if
All versions
Lbp113w
All versions
Lbp151dw
All versions
Lbp162
All versions
Lbp162dw
All versions
Lbp162l
All versions
Mf113w
All versions
Mf212w
All versions
Mf217w
All versions
Mf222dw
All versions
Mf224dw
All versions
Mf227dw
All versions
Mf229dw
All versions
Mf232w
All versions
Mf237w
All versions
Mf242dw
All versions
Mf244dw
All versions
Mf245dw
All versions
Mf247dw
All versions
Mf249dw
All versions
Mf262dw
All versions
Mf264dw
All versions
Mf265dw
All versions
Mf267dw
All versions
Mf269dw
All versions
Mf269dw Vp
All versions
Mf4570dn
All versions
Mf4570dw
All versions
Mf4770n
All versions
Mf4780w
All versions
Mf4880dw
All versions
Mf4890dw
All versions

Related CWEs

CWE-79
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

References (10)

Source: vultures@jpcert.or.jp
Vendor Advisory
Source: vultures@jpcert.or.jp
Third Party Advisory
Source: vultures@jpcert.or.jp
Third Party Advisory
Source: vultures@jpcert.or.jp
Vendor Advisory
Source: vultures@jpcert.or.jp
Vendor Advisory
Source: af854a3a-2127-422b-91ae-364da2661108
Vendor Advisory
Source: af854a3a-2127-422b-91ae-364da2661108
Third Party Advisory
Source: af854a3a-2127-422b-91ae-364da2661108
Third Party Advisory
Source: af854a3a-2127-422b-91ae-364da2661108
Vendor Advisory
Source: af854a3a-2127-422b-91ae-364da2661108
Vendor Advisory

Timeline

No history available yet.