Details of VAR-202004-0106

ID

VAR-202004-0106

CVE

CVE-2020-10093

TITLE

Lexmark Pro910 cross-site scripting vulnerability

Trust: 1.2

sources: CNVD: CNVD-2020-27450 // CNNVD: CNNVD-202004-2245

DESCRIPTION

A cross-site scripting (XSS) vulnerability in Lexmark Pro910 series inkjet and other discontinued products. Lexmark Pro910 is a Pro910 printer from Lexmark. The vulnerability stems from the lack of proper verification of client data by WEB applications. Attackers can use this vulnerability to execute client code

Trust: 2.25

sources: NVD: CVE-2020-10093 // JVNDB: JVNDB-2020-004892 // CNVD: CNVD-2020-27450 // VULMON: CVE-2020-10093

IOT TAXONOMY

category:

['IoT']

sub_category:

Trust: 0.6

sources: CNVD: CNVD-2020-27450

AFFECTED PRODUCTS

vendor:	lexmark	model:	mx71x	scope:	lte	version:	lw74.tu.p272	Trust: 1.0
vendor:	lexmark	model:	mx6500e	scope:	lte	version:	lw74.jd.p272	Trust: 1.0
vendor:	lexmark	model:	mx611	scope:	lte	version:	lw74.sb7.p272	Trust: 1.0
vendor:	lexmark	model:	c736	scope:	lte	version:	lr.ske.p824	Trust: 1.0
vendor:	lexmark	model:	ms317	scope:	lte	version:	lw74.prl.p272	Trust: 1.0
vendor:	lexmark	model:	ms818	scope:	lte	version:	lw74.dn2.p272	Trust: 1.0
vendor:	lexmark	model:	ms310	scope:	lte	version:	lw74.prl.p272	Trust: 1.0
vendor:	lexmark	model:	m3150dn	scope:	lte	version:	lw74.pr2.p272	Trust: 1.0
vendor:	lexmark	model:	cs748	scope:	lte	version:	lhs60.cm4.p737	Trust: 1.0
vendor:	lexmark	model:	c950	scope:	lte	version:	lhs60.tp.p737	Trust: 1.0
vendor:	lexmark	model:	ms417	scope:	lte	version:	lw74.tl2.p272	Trust: 1.0
vendor:	lexmark	model:	xm51xx	scope:	lte	version:	lw74.tu.p272	Trust: 1.0
vendor:	lexmark	model:	m1145	scope:	lte	version:	lw74.pr2.p272	Trust: 1.0
vendor:	lexmark	model:	w850	scope:	lte	version:	lp.jb.p823	Trust: 1.0
vendor:	lexmark	model:	e46x	scope:	lte	version:	lr.lbh.p824	Trust: 1.0
vendor:	lexmark	model:	xs79x	scope:	lte	version:	lhs60.mr.p737	Trust: 1.0
vendor:	lexmark	model:	ms610dn	scope:	lte	version:	lw74.pr2.p272	Trust: 1.0
vendor:	lexmark	model:	mx511	scope:	lte	version:	lw74.sb4.p272	Trust: 1.0
vendor:	lexmark	model:	mx31x	scope:	lte	version:	lw74.sb2.p272	Trust: 1.0
vendor:	lexmark	model:	cs796	scope:	lte	version:	lhs60.hc.p737	Trust: 1.0
vendor:	lexmark	model:	ms410	scope:	lte	version:	lw74.prl.p272	Trust: 1.0
vendor:	lexmark	model:	t65x	scope:	lte	version:	lr.jp.p824	Trust: 1.0
vendor:	lexmark	model:	m5163dn	scope:	lte	version:	lw74.dn2.p272	Trust: 1.0
vendor:	lexmark	model:	mx91x	scope:	lte	version:	lw74.mg.p272	Trust: 1.0
vendor:	lexmark	model:	m5155	scope:	lte	version:	lw74.dn4.p272	Trust: 1.0
vendor:	lexmark	model:	xm3150	scope:	lte	version:	lw74.sb7.p272	Trust: 1.0
vendor:	lexmark	model:	xc2132	scope:	lte	version:	lw74.gm7.p272	Trust: 1.0
vendor:	lexmark	model:	x95x	scope:	lte	version:	lhs60.tq.p737	Trust: 1.0
vendor:	lexmark	model:	cs41x	scope:	lte	version:	lw74.vy2.p272	Trust: 1.0
vendor:	lexmark	model:	ms810de	scope:	lte	version:	lw74.dn4.p272	Trust: 1.0
vendor:	lexmark	model:	ms810	scope:	lte	version:	lw74.dn2.p272	Trust: 1.0
vendor:	lexmark	model:	cx410	scope:	lte	version:	lw74.gm4.p272	Trust: 1.0
vendor:	lexmark	model:	x548	scope:	lte	version:	lhs60.vk.p737	Trust: 1.0
vendor:	lexmark	model:	xm1140	scope:	lte	version:	lw74.sb4.p272	Trust: 1.0
vendor:	lexmark	model:	c746	scope:	lte	version:	lhs60.cm2.p737	Trust: 1.0
vendor:	lexmark	model:	xs95x	scope:	lte	version:	lhs60.tq.p737	Trust: 1.0
vendor:	lexmark	model:	m5163	scope:	lte	version:	lw74.dn4.p272	Trust: 1.0
vendor:	lexmark	model:	x46x	scope:	lte	version:	lr.bs.p824	Trust: 1.0
vendor:	lexmark	model:	6500e	scope:	lte	version:	lhs60.jr.p737	Trust: 1.0
vendor:	lexmark	model:	x925	scope:	lte	version:	lhs60.hk.p737	Trust: 1.0
vendor:	lexmark	model:	xc2130	scope:	lte	version:	lw74.gm4.p272	Trust: 1.0
vendor:	lexmark	model:	mx510	scope:	lte	version:	lw74.sb4.p272	Trust: 1.0
vendor:	lexmark	model:	xm71xx	scope:	lte	version:	lw74.tu.p272	Trust: 1.0
vendor:	lexmark	model:	ms812de	scope:	lte	version:	lw74.dn7.p272	Trust: 1.0
vendor:	lexmark	model:	ms415	scope:	lte	version:	lw74.tl2.p272	Trust: 1.0
vendor:	lexmark	model:	ms91x	scope:	lte	version:	lw74.sa.p272	Trust: 1.0
vendor:	lexmark	model:	xm1145	scope:	lte	version:	lw74.sb4.p272	Trust: 1.0
vendor:	lexmark	model:	ms315	scope:	lte	version:	lw74.tl2.p272	Trust: 1.0
vendor:	lexmark	model:	ms617	scope:	lte	version:	lw74.pr2.p272	Trust: 1.0
vendor:	lexmark	model:	ms71x	scope:	lte	version:	lw74.dn2.p272	Trust: 1.0
vendor:	lexmark	model:	m1140	scope:	lte	version:	lw74.prl.p272	Trust: 1.0
vendor:	lexmark	model:	xs548	scope:	lte	version:	lhs60.vk.p737	Trust: 1.0
vendor:	lexmark	model:	c792	scope:	lte	version:	lhs60.hc.p737	Trust: 1.0
vendor:	lexmark	model:	mx610	scope:	lte	version:	lw74.sb7.p272	Trust: 1.0
vendor:	lexmark	model:	x74x	scope:	lte	version:	lhs60.ny.p737	Trust: 1.0
vendor:	lexmark	model:	xm91x	scope:	lte	version:	lw74.mg.p272	Trust: 1.0
vendor:	lexmark	model:	ms312	scope:	lte	version:	lw74.prl.p272	Trust: 1.0
vendor:	lexmark	model:	ms610de	scope:	lte	version:	lw74.pr4.p272	Trust: 1.0
vendor:	lexmark	model:	cs31x	scope:	lte	version:	lw74.vyl.p272	Trust: 1.0
vendor:	lexmark	model:	m3150	scope:	lte	version:	lw74.pr4.p272	Trust: 1.0
vendor:	lexmark	model:	ms812	scope:	lte	version:	lw74.dn2.p272	Trust: 1.0
vendor:	lexmark	model:	mx81x	scope:	lte	version:	lw74.tu.p272	Trust: 1.0
vendor:	lexmark	model:	x86x	scope:	lte	version:	lp.sp.p823	Trust: 1.0
vendor:	lexmark	model:	mx410	scope:	lte	version:	lw74.sb4.p272	Trust: 1.0
vendor:	lexmark	model:	x65x	scope:	lte	version:	lr.mn.p824	Trust: 1.0
vendor:	lexmark	model:	m5170	scope:	lte	version:	lw74.dn7.p272	Trust: 1.0
vendor:	lexmark	model:	xs925	scope:	lte	version:	lhs60.hk.p737	Trust: 1.0
vendor:	lexmark	model:	c734	scope:	lte	version:	lr.sk.p824	Trust: 1.0
vendor:	lexmark	model:	x73x	scope:	lte	version:	lr.fl.p824	Trust: 1.0
vendor:	lexmark	model:	xm1135	scope:	lte	version:	lw74.sb2.p272	Trust: 1.0
vendor:	lexmark	model:	x792	scope:	lte	version:	lhs60.mr.p737	Trust: 1.0
vendor:	lexmark	model:	c925	scope:	lte	version:	lhs60.hv.p737	Trust: 1.0
vendor:	lexmark	model:	ms811	scope:	lte	version:	lw74.dn2.p272	Trust: 1.0
vendor:	lexmark	model:	cx310	scope:	lte	version:	lw74.gm2.p272	Trust: 1.0
vendor:	lexmark	model:	xs748	scope:	lte	version:	lhs60.ny.p737	Trust: 1.0
vendor:	lexmark	model:	cs51x	scope:	lte	version:	lw74.vy4.p272	Trust: 1.0
vendor:	lexmark	model:	c748	scope:	lte	version:	lhs60.cm4.p737	Trust: 1.0
vendor:	lexmark	model:	cx510	scope:	lte	version:	lw74.gm7.p272	Trust: 1.0
vendor:	lexmark	model:	ms51x	scope:	lte	version:	lw74.pr2.p272	Trust: 1.0
vendor:	lexmark	model:	ms817	scope:	lte	version:	lw74.dn2.p272	Trust: 1.0
vendor:	lexmark	model:	cs31x	scope:	-	version:	-	Trust: 0.8
vendor:	lexmark	model:	cs41x	scope:	-	version:	-	Trust: 0.8
vendor:	lexmark	model:	cs51x	scope:	-	version:	-	Trust: 0.8
vendor:	lexmark	model:	cx310	scope:	-	version:	-	Trust: 0.8
vendor:	lexmark	model:	cx410	scope:	-	version:	-	Trust: 0.8
vendor:	lexmark	model:	ms310	scope:	-	version:	-	Trust: 0.8
vendor:	lexmark	model:	ms312	scope:	-	version:	-	Trust: 0.8
vendor:	lexmark	model:	mx51x	scope:	-	version:	-	Trust: 0.8
vendor:	lexmark	model:	mx61x	scope:	-	version:	-	Trust: 0.8
vendor:	lexmark	model:	xc2130	scope:	-	version:	-	Trust: 0.8
vendor:	lexmark	model:	pro910	scope:	-	version:	-	Trust: 0.6

sources: CNVD: CNVD-2020-27450 // JVNDB: JVNDB-2020-004892 // NVD: CVE-2020-10093

CVSS

SEVERITY

CVSSV2

CVSSV3

nvd@nist.gov:	CVE-2020-10093
value:	MEDIUM
Trust: 1.0
NVD:	JVNDB-2020-004892
value:	MEDIUM
Trust: 0.8
CNVD:	CNVD-2020-27450
value:	MEDIUM
Trust: 0.6
CNNVD:	CNNVD-202004-2245
value:	MEDIUM
Trust: 0.6
VULMON:	CVE-2020-10093
value:	LOW
Trust: 0.1

nvd@nist.gov:	CVE-2020-10093
severity:	LOW
baseScore:	3.5
vectorString:	AV:N/AC:M/AU:S/C:N/I:P/A:N
accessVector:	NETWORK
accessComplexity:	MEDIUM
authentication:	SINGLE
confidentialityImpact:	NONE
integrityImpact:	PARTIAL
availabilityImpact:	NONE
exploitabilityScore:	6.8
impactScore:	2.9
acInsufInfo:	NONE
obtainAllPrivilege:	NONE
obtainUserPrivilege:	NONE
obtainOtherPrivilege:	NONE
userInteractionRequired:	NONE
version:	2.0
Trust: 1.1
NVD:	JVNDB-2020-004892
severity:	LOW
baseScore:	3.5
vectorString:	AV:N/AC:M/AU:S/C:N/I:P/A:N
accessVector:	NETWORK
accessComplexity:	MEDIUM
authentication:	SINGLE
confidentialityImpact:	NONE
integrityImpact:	PARTIAL
availabilityImpact:	NONE
exploitabilityScore:	NONE
impactScore:	NONE
acInsufInfo:	NONE
obtainAllPrivilege:	NONE
obtainUserPrivilege:	NONE
obtainOtherPrivilege:	NONE
userInteractionRequired:	NONE
version:	2.0
Trust: 0.8
CNVD:	CNVD-2020-27450
severity:	MEDIUM
baseScore:	5.5
vectorString:	AV:N/AC:L/AU:S/C:P/I:P/A:N
accessVector:	NETWORK
accessComplexity:	LOW
authentication:	SINGLE
confidentialityImpact:	PARTIAL
integrityImpact:	PARTIAL
availabilityImpact:	NONE
exploitabilityScore:	8.0
impactScore:	4.9
acInsufInfo:	NONE
obtainAllPrivilege:	NONE
obtainUserPrivilege:	NONE
obtainOtherPrivilege:	NONE
userInteractionRequired:	NONE
version:	2.0
Trust: 0.6

nvd@nist.gov:	CVE-2020-10093
baseSeverity:	MEDIUM
baseScore:	5.4
vectorString:	CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
attackVector:	NETWORK
attackComplexity:	LOW
privilegesRequired:	LOW
userInteraction:	REQUIRED
scope:	CHANGED
confidentialityImpact:	LOW
integrityImpact:	LOW
availabilityImpact:	NONE
exploitabilityScore:	2.3
impactScore:	2.7
version:	3.1
Trust: 1.0
NVD:	JVNDB-2020-004892
baseSeverity:	MEDIUM
baseScore:	5.4
vectorString:	CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
attackVector:	NETWORK
attackComplexity:	LOW
privilegesRequired:	LOW
userInteraction:	REQUIRED
scope:	CHANGED
confidentialityImpact:	LOW
integrityImpact:	LOW
availabilityImpact:	NONE
exploitabilityScore:	NONE
impactScore:	NONE
version:	3.0
Trust: 0.8

sources: CNVD: CNVD-2020-27450 // VULMON: CVE-2020-10093 // JVNDB: JVNDB-2020-004892 // CNNVD: CNNVD-202004-2245 // NVD: CVE-2020-10093

PROBLEMTYPE DATA

problemtype:

CWE-79

Trust: 1.8

sources: JVNDB: JVNDB-2020-004892 // NVD: CVE-2020-10093

THREAT TYPE

remote

Trust: 0.6

sources: CNNVD: CNNVD-202004-2245

TYPE

XSS

Trust: 0.6

sources: CNNVD: CNNVD-202004-2245

CONFIGURATIONS

sources: JVNDB: JVNDB-2020-004892

PATCH

title:	Lexmark Security Advisory: Stored Cross Site Scripting Vulnerabilities (CVE-2020-10093, CVE-2020-10094)	url:	http://support.lexmark.com/index?page=content&id=TE936&locale=EN&userlocale=EN_US	Trust: 0.8
title:	Patch for Lexmark Pro910 cross-site scripting vulnerability	url:	https://www.cnvd.org.cn/patchInfo/show/216995	Trust: 0.6
title:	Lexmark Pro910 Fixes for cross-site scripting vulnerabilities	url:	http://www.cnnvd.org.cn/web/xxk/bdxqById.tag?id=117735	Trust: 0.6

sources: CNVD: CNVD-2020-27450 // JVNDB: JVNDB-2020-004892 // CNNVD: CNNVD-202004-2245

EXTERNAL IDS

db:	NVD	id:	CVE-2020-10093	Trust: 3.1
db:	JVNDB	id:	JVNDB-2020-004892	Trust: 0.8
db:	CNVD	id:	CNVD-2020-27450	Trust: 0.6
db:	CNNVD	id:	CNNVD-202004-2245	Trust: 0.6
db:	VULMON	id:	CVE-2020-10093	Trust: 0.1

sources: CNVD: CNVD-2020-27450 // VULMON: CVE-2020-10093 // JVNDB: JVNDB-2020-004892 // CNNVD: CNNVD-202004-2245 // NVD: CVE-2020-10093

REFERENCES

url:	http://support.lexmark.com/index?page=content&id=te936	Trust: 1.7
url:	https://nvd.nist.gov/vuln/detail/cve-2020-10093	Trust: 1.4
url:	https://cve.mitre.org/cgi-bin/cvename.cgi?name=cve-2020-10093	Trust: 0.8
url:	https://cwe.mitre.org/data/definitions/79.html	Trust: 0.1
url:	https://nvd.nist.gov	Trust: 0.1

sources: VULMON: CVE-2020-10093 // JVNDB: JVNDB-2020-004892 // CNNVD: CNNVD-202004-2245 // NVD: CVE-2020-10093

SOURCES

db:	CNVD	id:	CNVD-2020-27450
db:	VULMON	id:	CVE-2020-10093
db:	JVNDB	id:	JVNDB-2020-004892
db:	CNNVD	id:	CNNVD-202004-2245
db:	NVD	id:	CVE-2020-10093

LAST UPDATE DATE

2024-11-23T22:37:26.172000+00:00

SOURCES UPDATE DATE

db:	CNVD	id:	CNVD-2020-27450	date:	2020-05-09T00:00:00
db:	VULMON	id:	CVE-2020-10093	date:	2020-05-05T00:00:00
db:	JVNDB	id:	JVNDB-2020-004892	date:	2020-06-01T00:00:00
db:	CNNVD	id:	CNNVD-202004-2245	date:	2020-05-06T00:00:00
db:	NVD	id:	CVE-2020-10093	date:	2024-11-21T04:54:47.750

SOURCES RELEASE DATE

db:	CNVD	id:	CNVD-2020-27450	date:	2020-05-09T00:00:00
db:	VULMON	id:	CVE-2020-10093	date:	2020-04-28T00:00:00
db:	JVNDB	id:	JVNDB-2020-004892	date:	2020-06-01T00:00:00
db:	CNNVD	id:	CNNVD-202004-2245	date:	2020-04-28T00:00:00
db:	NVD	id:	CVE-2020-10093	date:	2020-04-28T14:15:13.330