CVE:CVE-2008-4419
CNNVD:CNNVD-200902-089
HP-ChaiSOE 1.0版本是一款内嵌在LaserJet 9040mfp, LaserJet 9050mfp和Color LaserJet 9500mfp 固件08.110.9之前版本；LaserJet 4345mfp and 9200C Digital Sender 固件09.120.9之前版本；Color LaserJet 4730mfp 固件46.200.9之前版本；LaserJet 2410, LaserJet 2420和LaserJet 2430 固件20080819 SPCL112A之前版本；LaserJet 4250 and LaserJet 4350 固件20080819 SPCL015A之前版本以及LaserJet 9040和LaserJet 9050 固件20080819 SPCL110A之前版本上的web服务器。HP-ChaiSOE 1.0中的HP JetDirect web管理界面存在目录遍历漏洞。远程攻击者可以借助URI中的目录遍历序列，读取任意文件。
solution:Upgrade hp 9200c_digital_sender to a higher version than 20081211_09.131.1,and avoid the version (,20081211_09.131.1]; Upgrade hp color_laserjet_4370mfp to a higher version than 20081211_46.211.2,and avoid the version (,20081211_46.211.2]; Upgrade hp color_laserjet_9500mfp to a higher version than 20070719_05.011.2,and avoid the version (,20070719_05.011.2]; Upgrade hp laserjet_2410 to a higher version than 20070410_08.112.3,and avoid the version (,20070410_08.112.3]; Upgrade hp laserjet_2420 to a higher version than 20070410_08.112.3,and avoid the version (,20070410_08.112.3]; Upgrade hp laserjet_2430 to a higher version than 20070410_08.112.3,and avoid the version (,20070410_08.112.3]; Upgrade hp laserjet_4250 to a higher version than 20080319_08.015.0,and avoid the version (,20080319_08.015.0]; Upgrade hp laserjet_4345mfp to a higher version than 20081211_09.131.1,and avoid the version (,20081211_09.131.1]; Upgrade hp laserjet_4350 to a higher version than 20080319_08.015.0,and avoid the version (,20080319_08.015.0]; Upgrade hp laserjet_9040 to a higher version than 20080204_08.110.0,and avoid the version (,20080204_08.110.0]; Upgrade hp laserjet_9040mfp to a higher version than 20080204_08.110.0,and avoid the version (,20080204_08.110.0]; Upgrade hp laserjet_9050 to a higher version than 20080204_08.110.0,and avoid the version (,20080204_08.110.0]; Upgrade hp laserjet_9050mfp to a higher version than 20080204_08.110.0,and avoid the version (,20080204_08.110.0]