p PatchFirst

CVE-2008-5184

CVE-2008-5184

This page contains facts from public vulnerability sources. Check the original advisory before updating.

The web interface (cgi-bin/admin.c) in CUPS before 1.3.8 uses the guest username when a user is not logged on to the web server, which makes it easier for remote attackers to bypass intended policy and conduct CSRF attacks via the (1) add and (2) cancel RSS subscription functions.

EPSS 3.7% · Fix available

Published
Updated

Stack: system

Affected products and versions

  • n/a

    Versions
    • n/a: Affected

    No fix published

  • cups Debian:12

    Affected ranges
    • ECOSYSTEM: < 1.3.8-1

    Update to 1.3.8-1

  • cups Debian:13

    Affected ranges
    • ECOSYSTEM: < 1.3.8-1

    Update to 1.3.8-1

  • cups Debian:14

    Affected ranges
    • ECOSYSTEM: < 1.3.8-1

    Update to 1.3.8-1

Original sources

Check your server →