Secunia

Some vulnerabilities have been reported in multiple HP LaserJet printers, HP Color LaserJet printers, and HP Digital Senders, which can be exploited by malicious people to conduct cross-site scripting attacks.

Input passed via the "Product_URL" and "Tech_URL" parameters to support_param.html/config is not properly sanitised before being used. This can be exploited to insert arbitrary HTML and script code, which is executed in a user's browser session in context of an affected site when the malicious data is returned.

Please see the vendor's advisory for a full list of affected products and versions.

Solution
Filter malicious characters and character sequences in a web proxy.
Further details available in Customer Area

Provided and/or discovered by
s.svistunovich and a.polyakov, Digital Security Research Group

Original Advisory
HPSBPI02463 SSRT090061:
http://h20000.www2.hp.com/bizsupport/TechSupport/Document.jsp?objectID=c01841397

Digital Security Research Group:
http://dsecrg.com/pages/vul/show.php?id=148

Deep Links
Links available in Customer Area