Cross-site scripting vulnerability in Canon laser printers and small office multifunctional printers (LBP162L/LBP162, MF4890dw, MF269dw/MF265dw/MF264dw/MF262dw, MF249dw/MF245dw/MF244dw/MF242dw/MF232w, and MF229dw/MF224dw/MF222dw sold in Japan, imageCLASS MF Series (MF113W/MF212W/MF217W/MF227DW/MF229DW, MF232W/MF244DW/MF247DW/MF249DW, MF264DW/MF267DW/MF269DW/MF269DW VP, and MF4570DN/MF4570DW/MF4770N/MF4880DW/MF4890DW) and imageCLASS LBP Series (LBP113W/LBP151DW/LBP162DW ) sold in the US, and iSENSYS (LBP162DW, LBP113W, LBP151DW, MF269dw, MF267dw, MF264dw, MF113w, MF249dw, MF247dw, MF244dw, MF237w, MF232w, MF229dw, MF217w, MF212w, MF4780w, and MF4890dw) and imageRUNNER (2206IF, 2204N, and 2204F) sold in Europe) allows remote attackers to inject an arbitrary script via unspecified vectors.

No CVSS v4.0

Attack Vector Network

Attack Complexity Low

Privileges Required High

Scope Changed

Confidentiality Impact Low

Integrity Impact Low

Availability Impact None

User Interaction Required

No CVSS v3.0

Access Vector Network

Access Complexity Medium

Authentication Single

Confidentiality Impact None

Integrity Impact Partial

Availability Impact None

This CVE is not in the KEV list.

The EPSS score is 0.00285.

Key SSVC decision points have not yet been added.

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions
Canon Canon laser printers and small office multifunctional printers affected
Version Status Constraints
LBP162L/LBP162, MF4890dw, MF269dw/MF265dw/MF264dw/MF262dw, MF249dw/MF245dw/MF244dw/MF242dw/MF232w, and MF229dw/MF224dw/MF222dw sold in Japan, imageCLASS MF Series(MF113W/MF212W/MF217W/MF227DW/MF229DW, MF232W/MF244DW/MF247DW/MF249DW, MF264DW/MF267DW/MF269DW/MF269DW VP, and MF4570DN/MF4570DW/MF4770N/MF4880DW/MF4890DW) and imageCLASS LBP Series(LBP113W/LBP151DW/LBP162DW ) sold in the US, and iSENSYS(LBP162DW, LBP113W, LBP151DW, MF269dw, MF267dw, MF264dw, MF113w, MF249dw, MF247dw, MF244dw, MF237w, MF232w, MF229dw, MF217w, MF212w, MF4780w, and MF4890dw) and imageRUNNER(2206IF, 2204N, and 2204F) sold in Europe affected —

Configuration 1 [-]

OR cpe:2.3:h:canon:2204f:-:*:*:*:*:*:*:*
cpe:2.3:h:canon:2204n:-:*:*:*:*:*:*:*
cpe:2.3:h:canon:2206if:-:*:*:*:*:*:*:*
cpe:2.3:h:canon:lbp113w:-:*:*:*:*:*:*:*
cpe:2.3:h:canon:lbp151dw:-:*:*:*:*:*:*:*
cpe:2.3:h:canon:lbp162:-:*:*:*:*:*:*:*
cpe:2.3:h:canon:lbp162dw:-:*:*:*:*:*:*:*
cpe:2.3:h:canon:lbp162l:-:*:*:*:*:*:*:*
cpe:2.3:h:canon:mf113w:-:*:*:*:*:*:*:*
cpe:2.3:h:canon:mf212w:-:*:*:*:*:*:*:*
cpe:2.3:h:canon:mf217w:-:*:*:*:*:*:*:*
cpe:2.3:h:canon:mf222dw:-:*:*:*:*:*:*:*
cpe:2.3:h:canon:mf224dw:-:*:*:*:*:*:*:*
cpe:2.3:h:canon:mf227dw:-:*:*:*:*:*:*:*
cpe:2.3:h:canon:mf229dw:-:*:*:*:*:*:*:*
cpe:2.3:h:canon:mf232w:-:*:*:*:*:*:*:*
cpe:2.3:h:canon:mf237w:-:*:*:*:*:*:*:*
cpe:2.3:h:canon:mf242dw:-:*:*:*:*:*:*:*
cpe:2.3:h:canon:mf244dw:-:*:*:*:*:*:*:*
cpe:2.3:h:canon:mf245dw:-:*:*:*:*:*:*:*
cpe:2.3:h:canon:mf247dw:-:*:*:*:*:*:*:*
cpe:2.3:h:canon:mf249dw:-:*:*:*:*:*:*:*
cpe:2.3:h:canon:mf262dw:-:*:*:*:*:*:*:*
cpe:2.3:h:canon:mf264dw:-:*:*:*:*:*:*:*
cpe:2.3:h:canon:mf265dw:-:*:*:*:*:*:*:*
cpe:2.3:h:canon:mf267dw:-:*:*:*:*:*:*:*
cpe:2.3:h:canon:mf269dw:-:*:*:*:*:*:*:*
cpe:2.3:h:canon:mf269dw_vp:-:*:*:*:*:*:*:*
cpe:2.3:h:canon:mf4570dn:-:*:*:*:*:*:*:*
cpe:2.3:h:canon:mf4570dw:-:*:*:*:*:*:*:*
cpe:2.3:h:canon:mf4770n:-:*:*:*:*:*:*:*
cpe:2.3:h:canon:mf4780w:-:*:*:*:*:*:*:*
cpe:2.3:h:canon:mf4880dw:-:*:*:*:*:*:*:*
cpe:2.3:h:canon:mf4890dw:-:*:*:*:*:*:*:*

No data.

No data.

Project Subscriptions

Vendors Products
Canon Subscribe
2204f Subscribe
2204n Subscribe
2206if Subscribe
Lbp113w Subscribe
Lbp151dw Subscribe
Lbp162 Subscribe
Lbp162dw Subscribe
Lbp162l Subscribe
Mf113w Subscribe
Mf212w Subscribe
Mf217w Subscribe
Mf222dw Subscribe
Mf224dw Subscribe
Mf227dw Subscribe
Mf229dw Subscribe
Mf232w Subscribe
Mf237w Subscribe
Mf242dw Subscribe
Mf244dw Subscribe
Mf245dw Subscribe
Mf247dw Subscribe
Mf249dw Subscribe
Mf262dw Subscribe
Mf264dw Subscribe
Mf265dw Subscribe
Mf267dw Subscribe
Mf269dw Subscribe
Mf269dw Vp Subscribe
Mf4570dn Subscribe
Mf4570dw Subscribe
Mf4770n Subscribe
Mf4780w Subscribe
Mf4880dw Subscribe
Mf4890dw Subscribe
Advisories
Source ID Title
EUVD EUVD EUVD-2021-8286 Cross-site scripting vulnerability in Canon laser printers and small office multifunctional printers (LBP162L/LBP162, MF4890dw, MF269dw/MF265dw/MF264dw/MF262dw, MF249dw/MF245dw/MF244dw/MF242dw/MF232w, and MF229dw/MF224dw/MF222dw sold in Japan, imageCLASS MF Series (MF113W/MF212W/MF217W/MF227DW/MF229DW, MF232W/MF244DW/MF247DW/MF249DW, MF264DW/MF267DW/MF269DW/MF269DW VP, and MF4570DN/MF4570DW/MF4770N/MF4880DW/MF4890DW) and imageCLASS LBP Series (LBP113W/LBP151DW/LBP162DW ) sold in the US, and iSENSYS (LBP162DW, LBP113W, LBP151DW, MF269dw, MF267dw, MF264dw, MF113w, MF249dw, MF247dw, MF244dw, MF237w, MF232w, MF229dw, MF217w, MF212w, MF4780w, and MF4890dw) and imageRUNNER (2206IF, 2204N, and 2204F) sold in Europe) allows remote attackers to inject an arbitrary script via unspecified vectors.
Fixes

Solution

No solution given by the vendor.

Workaround

No workaround given by the vendor.

References
Link Providers
https://cweb.canon.jp/e-support/info/211221xss.html cve-icon cve-icon
https://jvn.jp/en/jp/JVN64806328/index.html cve-icon cve-icon
https://jvn.jp/jp/JVN64806328/index.html cve-icon cve-icon
https://www.canon-europe.com/support/product-security-latest-news/ cve-icon cve-icon
https://www.usa.canon.com/internet/portal/us/home/support/product-advisories/detail/Service-Notice-Canon-Laser-Printer-and-Small-Office-Multifunctional-Printer-related-to-cross-site-scripting cve-icon cve-icon
History

No history.

Projects

Sign in to view the affected projects.

cve-icon MITRE

Status: PUBLISHED

Assigner: jpcert

Published:

Updated: 2024-08-03T17:53:23.123Z

Reserved: 2020-12-17T00:00:00

Link: CVE-2021-20877

cve-icon Vulnrichment

No data.

cve-icon NVD

Status : Modified

Published: 2022-02-08T11:15:07.663

Modified: 2024-11-21T05:47:20.040

Link: CVE-2021-20877

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

No data.

Weaknesses