CVE-2011-2722: hp linux_imaging_and_printing_project Link Following

Vulnerability summary

CVE-2011-2722 is a low (CVSS 1.2) Link Following vulnerability in hp linux_imaging_and_printing_project. EPSS estimates a 0.44% chance of exploitation in the next 30 days, higher than 37.1% of scored vulnerabilities.

Timeline

1. 25-05-2012
   PublishedVulnerability first disclosed.
2. 06-08-2024
   Last modifiedVulnerability information updated.

Description

The send_data_to_stdout function in prnt/hpijs/hpcupsfax.cpp in HP Linux Imaging and Printing (HPLIP) 3.x before 3.11.10 allows local users to overwrite arbitrary files via a symlink attack on the /tmp/hpcupsfax.out temporary file.

• CWE-59Improper Link Resolution Before File Access ('Link Following')The product attempts to access a file based on the filename, but it does not properly prevent that filename from identifying a link or shortcut that resolves to an unintended resource.