CVE-2023-40239 : Certain Lexmark devices (such as CS310) before 2023-08-25 allow XXE attacks, lea

Certain Lexmark devices (such as CS310) before 2023-08-25 allow XXE attacks, leading to information disclosure. The fixed firmware version is LW80.*.P246, i.e., '*' indicates that the full version specification varies across product model family, but firmware level P246 (or higher) is required to remediate the vulnerability.

Published 2023-09-01 11:15:43

Updated 2023-09-07 16:26:27

Source MITRE

View at NVD, CVE.org

Vulnerability category: XML external entity (XXE) injectionInformation leak

Products affected by CVE-2023-40239

Lexmark » Cx310 Firmware
Versions up to, including, (<=) lw80.gm2.p245
cpe:2.3:o:lexmark:cx310_firmware:*:*:*:*:*:*:*:*
Matching versions
When used together with: Lexmark » Cx310 » Version: N/A
Lexmark » Cx410 Firmware
Versions up to, including, (<=) lw80.gm4.p245
cpe:2.3:o:lexmark:cx410_firmware:*:*:*:*:*:*:*:*
Matching versions
When used together with: Lexmark » Cx410 » Version: N/A
Lexmark » Cx510 Firmware
Versions up to, including, (<=) lw80.gm7.p245
cpe:2.3:o:lexmark:cx510_firmware:*:*:*:*:*:*:*:*
Matching versions
When used together with: Lexmark » Cx510 » Version: N/A
Lexmark » Xc2132 Firmware
Versions up to, including, (<=) lw80.gm7.p245
cpe:2.3:o:lexmark:xc2132_firmware:*:*:*:*:*:*:*:*
Matching versions
When used together with: Lexmark » Xc2132 » Version: N/A
Lexmark » Xm1145 Firmware
Versions up to, including, (<=) lw80.sb4.p245
cpe:2.3:o:lexmark:xm1145_firmware:*:*:*:*:*:*:*:*
Matching versions
When used together with: Lexmark » Xm1145 » Version: N/A
Lexmark » Xm3150 Firmware
Versions up to, including, (<=) lw80.sb7.p245
cpe:2.3:o:lexmark:xm3150_firmware:*:*:*:*:*:*:*:*
Matching versions
When used together with: Lexmark » Xm3150 » Version: N/A
Lexmark » Ms310 Firmware
Versions up to, including, (<=) lw80.prl.p245
cpe:2.3:o:lexmark:ms310_firmware:*:*:*:*:*:*:*:*
Matching versions
When used together with: Lexmark » Ms310 » Version: N/A
Lexmark » Ms312 Firmware
Versions up to, including, (<=) lw80.prl.p245
cpe:2.3:o:lexmark:ms312_firmware:*:*:*:*:*:*:*:*
Matching versions
When used together with: Lexmark » Ms312 » Version: N/A
Lexmark » Ms317 Firmware
Versions up to, including, (<=) lw80.prl.p245
cpe:2.3:o:lexmark:ms317_firmware:*:*:*:*:*:*:*:*
Matching versions
When used together with: Lexmark » Ms317 » Version: N/A
Lexmark » Ms410 Firmware
Versions up to, including, (<=) lw80.prl.p245
cpe:2.3:o:lexmark:ms410_firmware:*:*:*:*:*:*:*:*
Matching versions
When used together with: Lexmark » Ms410 » Version: N/A
Lexmark » M1140 Firmware
Versions up to, including, (<=) lw80.prl.p245
cpe:2.3:o:lexmark:m1140_firmware:*:*:*:*:*:*:*:*
Matching versions
When used together with: Lexmark » M1140 » Version: N/A
Lexmark » Ms315 Firmware
Versions up to, including, (<=) lw80.tl2.p245
cpe:2.3:o:lexmark:ms315_firmware:*:*:*:*:*:*:*:*
Matching versions
When used together with: Lexmark » Ms315 » Version: N/A
Lexmark » Ms415 Firmware
Versions up to, including, (<=) lw80.tl2.p245
cpe:2.3:o:lexmark:ms415_firmware:*:*:*:*:*:*:*:*
Matching versions
When used together with: Lexmark » Ms415 » Version: N/A
Lexmark » Ms417 Firmware
Versions up to, including, (<=) lw80.tl2.p245
cpe:2.3:o:lexmark:ms417_firmware:*:*:*:*:*:*:*:*
Matching versions
When used together with: Lexmark » Ms417 » Version: N/A
Lexmark » Xm1135 Firmware
Versions up to, including, (<=) lw80.sb2.p245
cpe:2.3:o:lexmark:xm1135_firmware:*:*:*:*:*:*:*:*
Matching versions
When used together with: Lexmark » Xm1135 » Version: N/A
Lexmark » Ms610dn Firmware
Versions up to, including, (<=) lw80.pr2.p245
cpe:2.3:o:lexmark:ms610dn_firmware:*:*:*:*:*:*:*:*
Matching versions
When used together with: Lexmark » Ms610dn » Version: N/A
Lexmark » Ms617 Firmware
Versions up to, including, (<=) lw80.pr2.p245
cpe:2.3:o:lexmark:ms617_firmware:*:*:*:*:*:*:*:*
Matching versions
When used together with: Lexmark » Ms617 » Version: N/A
Lexmark » M1145 Firmware
Versions up to, including, (<=) lw80.pr2.p245
cpe:2.3:o:lexmark:m1145_firmware:*:*:*:*:*:*:*:*
Matching versions
When used together with: Lexmark » M1145 » Version: N/A
Lexmark » M3150dn Firmware
Versions up to, including, (<=) lw80.pr2.p245
cpe:2.3:o:lexmark:m3150dn_firmware:*:*:*:*:*:*:*:*
Matching versions
When used together with: Lexmark » M3150dn » Version: N/A
Lexmark » M5163dn Firmware
Versions up to, including, (<=) lw80.dn2.p245
cpe:2.3:o:lexmark:m5163dn_firmware:*:*:*:*:*:*:*:*
Matching versions
When used together with: Lexmark » M5163dn » Version: N/A
Lexmark » Ms811 Firmware
Versions up to, including, (<=) lw80.dn2.p245
cpe:2.3:o:lexmark:ms811_firmware:*:*:*:*:*:*:*:*
Matching versions
When used together with: Lexmark » Ms811 » Version: N/A
Lexmark » Ms817 Firmware
Versions up to, including, (<=) lw80.dn2.p245
cpe:2.3:o:lexmark:ms817_firmware:*:*:*:*:*:*:*:*
Matching versions
When used together with: Lexmark » Ms817 » Version: N/A
Lexmark » Ms818 Firmware
Versions up to, including, (<=) lw80.dn2.p245
cpe:2.3:o:lexmark:ms818_firmware:*:*:*:*:*:*:*:*
Matching versions
When used together with: Lexmark » Ms818 » Version: N/A
Lexmark » Ms810de Firmware
Versions up to, including, (<=) lw80.dn4.p245
cpe:2.3:o:lexmark:ms810de_firmware:*:*:*:*:*:*:*:*
Matching versions
When used together with: Lexmark » Ms810de » Version: N/A
Lexmark » M5155 Firmware
Versions up to, including, (<=) lw80.dn4.p245
cpe:2.3:o:lexmark:m5155_firmware:*:*:*:*:*:*:*:*
Matching versions
When used together with: Lexmark » M5155 » Version: N/A
Lexmark » Ms812de Firmware
Versions up to, including, (<=) lw80.dn7.p245
cpe:2.3:o:lexmark:ms812de_firmware:*:*:*:*:*:*:*:*
Matching versions
When used together with: Lexmark » Ms812de » Version: N/A
Lexmark » M5170 Firmware
Versions up to, including, (<=) lw80.dn7.p245
cpe:2.3:o:lexmark:m5170_firmware:*:*:*:*:*:*:*:*
Matching versions
When used together with: Lexmark » M5170 » Version: N/A
Lexmark » Mx410 Firmware
Versions up to, including, (<=) lw80.sb4.p245
cpe:2.3:o:lexmark:mx410_firmware:*:*:*:*:*:*:*:*
Matching versions
When used together with: Lexmark » Mx410 » Version: N/A
Lexmark » Mx510 Firmware
Versions up to, including, (<=) lw80.sb4.p245
cpe:2.3:o:lexmark:mx510_firmware:*:*:*:*:*:*:*:*
Matching versions
When used together with: Lexmark » Mx510 » Version: N/A
Lexmark » Mx511 Firmware
Versions up to, including, (<=) lw80.sb4.p245
cpe:2.3:o:lexmark:mx511_firmware:*:*:*:*:*:*:*:*
Matching versions
When used together with: Lexmark » Mx511 » Version: N/A
Lexmark » Mx610 Firmware
Versions up to, including, (<=) lw80.sb7.p245
cpe:2.3:o:lexmark:mx610_firmware:*:*:*:*:*:*:*:*
Matching versions
When used together with: Lexmark » Mx610 » Version: N/A
Lexmark » Mx611 Firmware
Versions up to, including, (<=) lw80.sb7.p245
cpe:2.3:o:lexmark:mx611_firmware:*:*:*:*:*:*:*:*
Matching versions
When used together with: Lexmark » Mx611 » Version: N/A
Lexmark » Ms610de Firmware
Versions up to, including, (<=) lw80.pr4.p245
cpe:2.3:o:lexmark:ms610de_firmware:*:*:*:*:*:*:*:*
Matching versions
When used together with: Lexmark » Ms610de » Version: N/A
Lexmark » Xc2130 Firmware
Versions up to, including, (<=) lw80.gm4.p245
cpe:2.3:o:lexmark:xc2130_firmware:*:*:*:*:*:*:*:*
Matching versions
When used together with: Lexmark » Xc2130 » Version: N/A
Lexmark » Xm1140 Firmware
Versions up to, including, (<=) lw80.sb4.p245
cpe:2.3:o:lexmark:xm1140_firmware:*:*:*:*:*:*:*:*
Matching versions
When used together with: Lexmark » Xm1140 » Version: N/A
Lexmark » Xm5163 Firmware
Versions up to, including, (<=) lw80.tu.p245
cpe:2.3:o:lexmark:xm5163_firmware:*:*:*:*:*:*:*:*
Matching versions
When used together with: Lexmark » Xm5163 » Version: N/A
Lexmark » Xm5170 Firmware
Versions up to, including, (<=) lw80.tu.p245
cpe:2.3:o:lexmark:xm5170_firmware:*:*:*:*:*:*:*:*
Matching versions
When used together with: Lexmark » Xm5170 » Version: N/A
Lexmark » Xm7155 Firmware
Versions up to, including, (<=) lw80.tu.p245
cpe:2.3:o:lexmark:xm7155_firmware:*:*:*:*:*:*:*:*
Matching versions
When used together with: Lexmark » Xm7155 » Version: N/A
Lexmark » Xm7163 Firmware
Versions up to, including, (<=) lw80.tu.p245
cpe:2.3:o:lexmark:xm7163_firmware:*:*:*:*:*:*:*:*
Matching versions
When used together with: Lexmark » Xm7163 » Version: N/A
Lexmark » Xm7170 Firmware
Versions up to, including, (<=) lw80.tu.p245
cpe:2.3:o:lexmark:xm7170_firmware:*:*:*:*:*:*:*:*
Matching versions
When used together with: Lexmark » Xm7170 » Version: N/A
Lexmark » Ms510 Firmware
Versions up to, including, (<=) lw80.pr2.p245
cpe:2.3:o:lexmark:ms510_firmware:*:*:*:*:*:*:*:*
Matching versions
When used together with: Lexmark » Ms510 » Version: N/A
Lexmark » Ms517 Firmware
Versions up to, including, (<=) lw80.pr2.p245
cpe:2.3:o:lexmark:ms517_firmware:*:*:*:*:*:*:*:*
Matching versions
When used together with: Lexmark » Ms517 » Version: N/A
Lexmark » M1140+ Firmware
Versions up to, including, (<=) lw80.pr2.p245
cpe:2.3:o:lexmark:m1140\+_firmware:*:*:*:*:*:*:*:*
Matching versions
When used together with: Lexmark » M1140+ » Version: N/A
Lexmark » M3150de Firmware
Versions up to, including, (<=) lw80.pr4.p245
cpe:2.3:o:lexmark:m3150de_firmware:*:*:*:*:*:*:*:*
Matching versions
When used together with: Lexmark » M3150de » Version: N/A
Lexmark » Mx310 Firmware
Versions up to, including, (<=) lw80.sb2.p245
cpe:2.3:o:lexmark:mx310_firmware:*:*:*:*:*:*:*:*
Matching versions
When used together with: Lexmark » Mx310 » Version: N/A
Lexmark » Mx317 Firmware
Versions up to, including, (<=) lw80.sb2.p245
cpe:2.3:o:lexmark:mx317_firmware:*:*:*:*:*:*:*:*
Matching versions
When used together with: Lexmark » Mx317 » Version: N/A
Lexmark » Mx417 Firmware
Versions up to, including, (<=) lw80.sb4.p245
cpe:2.3:o:lexmark:mx417_firmware:*:*:*:*:*:*:*:*
Matching versions
When used together with: Lexmark » Mx417 » Version: N/A
Lexmark » Mx517 Firmware
Versions up to, including, (<=) lw80.sb4.p245
cpe:2.3:o:lexmark:mx517_firmware:*:*:*:*:*:*:*:*
Matching versions
When used together with: Lexmark » Mx517 » Version: N/A
Lexmark » Mx617 Firmware
Versions up to, including, (<=) lw80.sb7.p245
cpe:2.3:o:lexmark:mx617_firmware:*:*:*:*:*:*:*:*
Matching versions
When used together with: Lexmark » Mx617 » Version: N/A
Lexmark » Ms710 Firmware
Versions up to, including, (<=) lw80.dn2.p245
cpe:2.3:o:lexmark:ms710_firmware:*:*:*:*:*:*:*:*
Matching versions
When used together with: Lexmark » Ms710 » Version: N/A
Lexmark » Ms711 Firmware
Versions up to, including, (<=) lw80.dn2.p245
cpe:2.3:o:lexmark:ms711_firmware:*:*:*:*:*:*:*:*
Matching versions
When used together with: Lexmark » Ms711 » Version: N/A
Lexmark » Ms810dn Firmware
Versions up to, including, (<=) lw80.dn2.p245
cpe:2.3:o:lexmark:ms810dn_firmware:*:*:*:*:*:*:*:*
Matching versions
When used together with: Lexmark » Ms810dn » Version: N/A
Lexmark » Ms812dn Firmware
Versions up to, including, (<=) lw80.dn2.p245
cpe:2.3:o:lexmark:ms812dn_firmware:*:*:*:*:*:*:*:*
Matching versions
When used together with: Lexmark » Ms812dn » Version: N/A
Lexmark » M5163de Firmware
Versions up to, including, (<=) lw80.dn4.p245
cpe:2.3:o:lexmark:m5163de_firmware:*:*:*:*:*:*:*:*
Matching versions
When used together with: Lexmark » M5163de » Version: N/A
Lexmark » Mx710 Firmware
Versions up to, including, (<=) lw80.tu.p245
cpe:2.3:o:lexmark:mx710_firmware:*:*:*:*:*:*:*:*
Matching versions
When used together with: Lexmark » Mx710 » Version: N/A
Lexmark » Mx711 Firmware
Versions up to, including, (<=) lw80.tu.p245
cpe:2.3:o:lexmark:mx711_firmware:*:*:*:*:*:*:*:*
Matching versions
When used together with: Lexmark » Mx711 » Version: N/A
Lexmark » Mx717 Firmware
Versions up to, including, (<=) lw80.tu.p245
cpe:2.3:o:lexmark:mx717_firmware:*:*:*:*:*:*:*:*
Matching versions
When used together with: Lexmark » Mx717 » Version: N/A
Lexmark » Mx718 Firmware
Versions up to, including, (<=) lw80.tu.p245
cpe:2.3:o:lexmark:mx718_firmware:*:*:*:*:*:*:*:*
Matching versions
When used together with: Lexmark » Mx718 » Version: N/A
Lexmark » Mx810 Firmware
Versions up to, including, (<=) lw80.tu.p245
cpe:2.3:o:lexmark:mx810_firmware:*:*:*:*:*:*:*:*
Matching versions
When used together with: Lexmark » Mx810 » Version: N/A
Lexmark » Mx811 Firmware
Versions up to, including, (<=) lw80.tu.p245
cpe:2.3:o:lexmark:mx811_firmware:*:*:*:*:*:*:*:*
Matching versions
When used together with: Lexmark » Mx811 » Version: N/A
Lexmark » Mx812 Firmware
Versions up to, including, (<=) lw80.tu.p245
cpe:2.3:o:lexmark:mx812_firmware:*:*:*:*:*:*:*:*
Matching versions
When used together with: Lexmark » Mx812 » Version: N/A
Lexmark » Xm5263 Firmware
Versions up to, including, (<=) lw80.tu.p245
cpe:2.3:o:lexmark:xm5263_firmware:*:*:*:*:*:*:*:*
Matching versions
When used together with: Lexmark » Xm5263 » Version: N/A
Lexmark » Xm5270 Firmware
Versions up to, including, (<=) lw80.tu.p245
cpe:2.3:o:lexmark:xm5270_firmware:*:*:*:*:*:*:*:*
Matching versions
When used together with: Lexmark » Xm5270 » Version: N/A
Lexmark » Xm7263 Firmware
Versions up to, including, (<=) lw80.tu.p245
cpe:2.3:o:lexmark:xm7263_firmware:*:*:*:*:*:*:*:*
Matching versions
When used together with: Lexmark » Xm7263 » Version: N/A
Lexmark » Xm7270 Firmware
Versions up to, including, (<=) lw80.tu.p245
cpe:2.3:o:lexmark:xm7270_firmware:*:*:*:*:*:*:*:*
Matching versions
When used together with: Lexmark » Xm7270 » Version: N/A
Lexmark » Ms911 Firmware
Versions up to, including, (<=) lw80.sa.p245
cpe:2.3:o:lexmark:ms911_firmware:*:*:*:*:*:*:*:*
Matching versions
When used together with: Lexmark » Ms911 » Version: N/A
Lexmark » Mx910 Firmware
Versions up to, including, (<=) lw80.mg.p245
cpe:2.3:o:lexmark:mx910_firmware:*:*:*:*:*:*:*:*
Matching versions
When used together with: Lexmark » Mx910 » Version: N/A
Lexmark » Mx911 Firmware
Versions up to, including, (<=) lw80.mg.p245
cpe:2.3:o:lexmark:mx911_firmware:*:*:*:*:*:*:*:*
Matching versions
When used together with: Lexmark » Mx911 » Version: N/A
Lexmark » Mx912 Firmware
Versions up to, including, (<=) lw80.mg.p245
cpe:2.3:o:lexmark:mx912_firmware:*:*:*:*:*:*:*:*
Matching versions
When used together with: Lexmark » Mx912 » Version: N/A
Lexmark » Xm9145 Firmware
Versions up to, including, (<=) lw80.mg.p245
cpe:2.3:o:lexmark:xm9145_firmware:*:*:*:*:*:*:*:*
Matching versions
When used together with: Lexmark » Xm9145 » Version: N/A
Lexmark » Xm9155 Firmware
Versions up to, including, (<=) lw80.mg.p245
cpe:2.3:o:lexmark:xm9155_firmware:*:*:*:*:*:*:*:*
Matching versions
When used together with: Lexmark » Xm9155 » Version: N/A
Lexmark » Xm9165 Firmware
Versions up to, including, (<=) lw80.mg.p245
cpe:2.3:o:lexmark:xm9165_firmware:*:*:*:*:*:*:*:*
Matching versions
When used together with: Lexmark » Xm9165 » Version: N/A
Lexmark » Cs310 Firmware
Versions up to, including, (<=) lw80.vyl.p245
cpe:2.3:o:lexmark:cs310_firmware:*:*:*:*:*:*:*:*
Matching versions
When used together with: Lexmark » Cs310 » Version: N/A
Lexmark » Cs317 Firmware
Versions up to, including, (<=) lw80.vyl.p245
cpe:2.3:o:lexmark:cs317_firmware:*:*:*:*:*:*:*:*
Matching versions
When used together with: Lexmark » Cs317 » Version: N/A
Lexmark » Cs417 Firmware
Versions up to, including, (<=) lw80.vy2.p245
cpe:2.3:o:lexmark:cs417_firmware:*:*:*:*:*:*:*:*
Matching versions
When used together with: Lexmark » Cs417 » Version: N/A
Lexmark » Cs410 Firmware
Versions up to, including, (<=) lw80.vy2.p245
cpe:2.3:o:lexmark:cs410_firmware:*:*:*:*:*:*:*:*
Matching versions
When used together with: Lexmark » Cs410 » Version: N/A
Lexmark » Cs510 Firmware
Versions up to, including, (<=) lw80.vy4.p245
cpe:2.3:o:lexmark:cs510_firmware:*:*:*:*:*:*:*:*
Matching versions
When used together with: Lexmark » Cs510 » Version: N/A
Lexmark » Cs517 Firmware
Versions up to, including, (<=) lw80.vy4.p245
cpe:2.3:o:lexmark:cs517_firmware:*:*:*:*:*:*:*:*
Matching versions
When used together with: Lexmark » Cs517 » Version: N/A
Lexmark » C2132 Firmware
Versions up to, including, (<=) lw80.vy4.p245
cpe:2.3:o:lexmark:c2132_firmware:*:*:*:*:*:*:*:*
Matching versions
When used together with: Lexmark » C2132 » Version: N/A
Lexmark » Cx317 Firmware
Versions up to, including, (<=) lw80.gm2.p245
cpe:2.3:o:lexmark:cx317_firmware:*:*:*:*:*:*:*:*
Matching versions
When used together with: Lexmark » Cx317 » Version: N/A
Lexmark » Cx417 Firmware
Versions up to, including, (<=) lw80.gm4.p245
cpe:2.3:o:lexmark:cx417_firmware:*:*:*:*:*:*:*:*
Matching versions
When used together with: Lexmark » Cx417 » Version: N/A
Lexmark » Cx517 Firmware
Versions up to, including, (<=) lw80.gm7.p245
cpe:2.3:o:lexmark:cx517_firmware:*:*:*:*:*:*:*:*
Matching versions
When used together with: Lexmark » Cx517 » Version: N/A

Exploit prediction scoring system (EPSS) score for CVE-2023-40239

EPSS FAQ

0.14%

Probability of exploitation activity in the next 30 days EPSS Score History

~ 50 %

Percentile, the proportion of vulnerabilities that are scored at or less

CVSS scores for CVE-2023-40239

Base Score	Base Severity	CVSS Vector	Exploitability Score	Impact Score	Score Source	First Seen
7.5	HIGH	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N	3.9	3.6	NIST
Attack Vector: Network Attack Complexity: Low Privileges Required: None User Interaction: None Scope: Unchanged Confidentiality: High Integrity: None Availability: None

CWE ids for CVE-2023-40239

CWE-611 Improper Restriction of XML External Entity Reference

The product processes an XML document that can contain XML entities with URIs that resolve to documents outside of the intended sphere of control, causing the product to embed incorrect documents into its output.

Assigned by: nvd@nist.gov (Primary)

References for CVE-2023-40239

https://publications.lexmark.com/publications/security-alerts/CVE-2023-40239.pdf

Vendor Advisory

Jump to

Vulnerability Details : CVE-2023-40239

Products affected by CVE-2023-40239

Exploit prediction scoring system (EPSS) score for CVE-2023-40239

CVSS scores for CVE-2023-40239

CWE ids for CVE-2023-40239

References for CVE-2023-40239