Vulnerability record · CVE-2008-5184 · published 21 November 2008

CVE-2008-5184: Apple cups vulnerability

Apple · Cups

The web interface (cgi-bin/admin.c) in CUPS before 1.3.8 uses the guest username when a user is not logged on to the web server, which makes it easier for remote attackers to bypass intended policy and conduct CSRF attacks via the (1) add and (2) cancel RSS subscription functions.

10.0 CVSS 2.0 High EPSS 3.7% · top 10.7% CWE-255 · CWE-255

10.0CVSS 2.0 base score

3.7%EPSS exploitation probability, 30 days

NoNot in CISA KEV

1Affected product versions listed by NVD

10References, 2 tagged exploit

16 Jun 2026Last modified by NVD

Description

AV:N/AC:L/Au:N/C:C/I:C/A:C

Affected products

1 vulnerable configurations from NVD's CPE data, grouped by vendor and product.

Cups Apple

References

Link	Tags
http://lists.opensuse.org/opensuse-security-announce/2008-11/msg00002.html
http://www.cups.org/str.php?L2774
http://www.gnucitizen.org/blog/pwning-ubuntu-via-cups/	Exploit
http://www.mandriva.com/security/advisories?name=MDVSA-2009:028
http://www.openwall.com/lists/oss-security/2008/11/19/3
http://lists.opensuse.org/opensuse-security-announce/2008-11/msg00002.html
http://www.cups.org/str.php?L2774
http://www.gnucitizen.org/blog/pwning-ubuntu-via-cups/	Exploit
http://www.mandriva.com/security/advisories?name=MDVSA-2009:028
http://www.openwall.com/lists/oss-security/2008/11/19/3

Track CVE-2008-5184 inside VULONE

Watch it alongside the ransomware crews, C2 infrastructure and forum chatter that reference it, query it through the API and pull it into your SIEM over TAXII.

Start free Open in platform

Related vulnerabilities

Same products first, then exploited flaws of the same weakness class.

10.0CVE-2008-3641Apple cups vulnerabilityThe Hewlett-Packard Graphics Language (HPGL) filter in CUPS before 1.3.9 allows remote attackers to execute arbitrary code via crafted pen width and …EPSS 24%10 Oct 2008 10.0CVE-2008-0053Apple cups memory buffer overflow vulnerabilityMultiple buffer overflows in the HP-GL/2-to-PostScript filter in CUPS before 1.3.6 might allow remote attackers to execute arbitrary code via a craft…EPSS 8.3%18 Mar 2008 9.8CVE-2012-6094Apple cups incorrect authorization vulnerabilitycups (Common Unix Printing System) 'Listen localhost:631' option not honored correctly which could provide unauthorized access to the systemEPSS 2.1%20 Dec 2019 9.8CVE-2010-2941Apple cups use after free vulnerabilityipp.c in cupsd in CUPS 1.4.4 and earlier does not properly allocate memory for attribute values with invalid string data types, which allows remote a…EPSS 6.4%5 Nov 2010 9.8CVE-2004-2154Apple cups vulnerabilityCUPS before 1.1.21rc1 treats a Location directive in cupsd.conf as case sensitive, which allows attackers to bypass intended ACLs via a printer name …EPSS 2.1%31 Dec 2004 7.5CVE-2017-18190Apple cups authentication bypass by spoofing vulnerabilityA localhost.localdomain whitelist entry in valid_host() in scheduler/client.c in CUPS before 2.2.2 allows remote attackers to execute arbitrary IPP c…EPSS 2.9%16 Feb 2018 7.5CVE-2010-3702Apple cups null pointer dereference vulnerabilityThe Gfx::getPos function in the PDF parser in xpdf before 3.02pl5, poppler 0.8.7 and possibly other versions up to 0.15.1, CUPS, kdegraphics, and pos…EPSS 2.8%5 Nov 2010 7.5CVE-2010-0302Apple cups use after free vulnerabilityUse-after-free vulnerability in the abstract file-descriptor handling interface in the cupsdDoSelect function in scheduler/select.c in the scheduler …EPSS 2.6%5 Mar 2010

Source: NIST National Vulnerability Database (record CVE-2008-5184), CISA KEV, FIRST EPSS (scores of 2026-09-26). This page is refreshed as NVD updates the record.