{"cve":"CVE-2008-4419","nvd":{"published":"2009-02-05T00:30:00.203","modified":"2026-06-16T22:57:46.837","status":"Modified","description":"Directory traversal vulnerability in the HP JetDirect web administration interface in the HP-ChaiSOE 1.0 embedded web server on the LaserJet 9040mfp, LaserJet 9050mfp, and Color LaserJet 9500mfp before firmware 08.110.9; LaserJet 4345mfp and 9200C Digital Sender before firmware 09.120.9; Color LaserJet 4730mfp before firmware 46.200.9; LaserJet 2410, LaserJet 2420, and LaserJet 2430 before firmware 20080819 SPCL112A; LaserJet 4250 and LaserJet 4350 before firmware 20080819 SPCL015A; and LaserJet 9040 and LaserJet 9050 before firmware 20080819 SPCL110A allows remote attackers to read arbitrary files via directory traversal sequences in the URI.","cvss_v4":null,"cvss_v3":null,"cwes":["CWE-22"],"references":["http://h20000.www2.hp.com/bizsupport/TechSupport/Document.jsp?objectID=c01623905","http://secunia.com/advisories/33779","http://www.securityfocus.com/archive/1/500657/100/0/threaded","http://www.securityfocus.com/bid/33611","http://www.securitytracker.com/id?1021687"],"products":["hp:9200c_digital_sender","hp:color_laserjet_4370mfp","hp:color_laserjet_9500mfp","hp:laserjet_2410","hp:laserjet_2420","hp:laserjet_2430","hp:laserjet_4250","hp:laserjet_4345mfp","hp:laserjet_4350","hp:laserjet_9040","hp:laserjet_9040mfp","hp:laserjet_9050","hp:laserjet_9050mfp"],"source":"nvd","synced_at":"2026-10-19T19:53:23.791937413+00:00"},"epss":{"cve":"CVE-2008-4419","score":0.07395,"percentile":0.94429,"date":"2026-10-31"},"kev":null,"osv":[],"attribution":["This product uses the NVD API but is not endorsed or certified by the NVD.","EPSS scores: FIRST Exploit Prediction Scoring System, https://www.first.org/epss","Known exploited vulnerabilities: CISA Known Exploited Vulnerabilities Catalog, https://www.cisa.gov/known-exploited-vulnerabilities-catalog","Package advisories: OSV (https://osv.dev), from the GitHub Advisory Database, PyPA, Go, RustSec and other ecosystem databases, under CC-BY 4.0 or CC0","CVE records: the CVE Program's CVE List (https://www.cve.org), under its terms of use (https://www.cve.org/Legal/TermsOfUse). CVE is a registered trademark of The MITRE Corporation; this product is not affiliated with the CVE Program."]}