CVE-2011-4166 Directory traversal vulnerability in the MPAUploader.Uploader.1.UploadFiles method in HP Managed Printing Administration before 2.6.4 allows remote attackers to create arbitrary files via crafted form...

HighCVSS 7.5 EPSS 58.3% Framework module Public exploit

Published: 2011-12-27 04:00
Updated: 2026-06-17 02:34
Exploit status: Public exploit available

Description

Directory traversal vulnerability in the MPAUploader.Uploader.1.UploadFiles method in HP Managed Printing Administration before 2.6.4 allows remote attackers to create arbitrary files via crafted form data.

Affected products

Product	Affected versions	Fixed in
HP Inc managed printing administration	<= 2.6.3	No fix listed

References

HPSBPI02732 vendor-advisory
www.zerodayinitiative.com

CVSS v2.0

7.5 High

AV:N/AC:L/Au:N/C:P/I:P/A:P

Access Vector: Network
Access Complexity: Low
Authentication: None
Confidentiality: Partial
Integrity: Partial
Availability: Partial

Weakness & likelihood

EPSS (exploitation probability, 30 days): 58.34% (percentile 99.1)
CWE: CWE-22

Public exploit references

Metadata only. CVERadar never hosts or runs exploit code.

HP Managed Printing Administration jobAcct Remote Command Execution Framework module · Metasploit Framework (Rapid7) · 2011-12-21
HP Managed Printing Administration - jobAcct Remote Command Execution (Metasploit) Exploit · Exploit Database (OffSec) · 2013-07-22