Read the docs
TI-2019-04491 Aliases CVE-2019-6325GHSA-gv4j-7g97-xgmq

Cross-site request forgery in HP Color LaserJet Pro M280-M281 Multifunction Printer…

Priority MEDIUM 40CWE-352Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
Required
Attack complexity
Low
Impact type
Tampering
Confidentiality · integrity · availability
High · High · High
Fix status
Fixed

Attack profile from CVSS 3.0 · NVD. Fix status from CNA. Impact type from CWE-352.

Summary

HP Color LaserJet Pro M280-M281 Multifunction Printer series (before v. 20190419), HP LaserJet Pro MFP M28-M31 Printer series (before v. 20190426) may have an embedded web server that is potentially vulnerable to Cross-site Request Forgery.

Why it matters now

EPSS 0.00983 62nd percentileScored 2026-11-07
Fix Fixed HP Color LaserJet Pro M280-M281 Multifunction Printer series; HP LaserJet Pro MFP M28-M31 Printer series: 20190419, 20190426

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
—HP Color LaserJet Pro M280-M281 Multifunction Printer series; HP LaserJet Pro MFP M28-M31 Printer seriesbefore 20190419; before 2019042620190419, 20190426Patch availableCNA
  • HP Color LaserJet Pro M280-M281 Multifunction Printer series; HP LaserJet Pro MFP M28-M31 Printer series Vendor— Affected before 20190419; before 20190426 Fixed in 20190419, 20190426 Patch available CNA

CPE configurations NVD · 20

CPEVersionsRoleVendor
cpe:2.3:o:hp:t6b80a_firmware:*:*:*:*:*:*:*:*before 2019-04-19VulnerableHewlett Packard Enterprise
cpe:2.3:h:hp:t6b80a:-:*:*:*:*:*:*:*not specified by NVDRunning onHewlett Packard Enterprise
cpe:2.3:o:hp:t6b83a_firmware:*:*:*:*:*:*:*:*before 2019-04-19VulnerableHewlett Packard Enterprise
cpe:2.3:h:hp:t6b83a:-:*:*:*:*:*:*:*not specified by NVDRunning onHewlett Packard Enterprise
cpe:2.3:o:hp:t6b81a_firmware:*:*:*:*:*:*:*:*before 2019-04-19VulnerableHewlett Packard Enterprise
cpe:2.3:h:hp:t6b81a:-:*:*:*:*:*:*:*not specified by NVDRunning onHewlett Packard Enterprise
cpe:2.3:o:hp:t6b82a_firmware:*:*:*:*:*:*:*:*before 2019-04-19VulnerableHewlett Packard Enterprise
cpe:2.3:h:hp:t6b82a:-:*:*:*:*:*:*:*not specified by NVDRunning onHewlett Packard Enterprise
cpe:2.3:o:hp:w2g54a_firmware:*:*:*:*:*:*:*:*before 2019-04-26VulnerableHewlett Packard Enterprise
cpe:2.3:h:hp:w2g54a:-:*:*:*:*:*:*:*not specified by NVDRunning onHewlett Packard Enterprise
Show 10 more CPE
CPEVersionsRoleVendor
cpe:2.3:o:hp:w2g55a_firmware:*:*:*:*:*:*:*:*before 2019-04-26VulnerableHewlett Packard Enterprise
cpe:2.3:h:hp:w2g55a:-:*:*:*:*:*:*:*not specified by NVDRunning onHewlett Packard Enterprise
cpe:2.3:o:hp:y5s53a_firmware:*:*:*:*:*:*:*:*before 2019-04-26VulnerableHewlett Packard Enterprise
cpe:2.3:h:hp:y5s53a:-:*:*:*:*:*:*:*not specified by NVDRunning onHewlett Packard Enterprise
cpe:2.3:o:hp:y5s55a_firmware:*:*:*:*:*:*:*:*before 2019-04-26VulnerableHewlett Packard Enterprise
cpe:2.3:h:hp:y5s55a:-:*:*:*:*:*:*:*not specified by NVDRunning onHewlett Packard Enterprise
cpe:2.3:o:hp:y5s50a_firmware:*:*:*:*:*:*:*:*before 2019-04-26VulnerableHewlett Packard Enterprise
cpe:2.3:h:hp:y5s50a:-:*:*:*:*:*:*:*not specified by NVDRunning onHewlett Packard Enterprise
cpe:2.3:o:hp:y5s54a_firmware:*:*:*:*:*:*:*:*before 2019-04-26VulnerableHewlett Packard Enterprise
cpe:2.3:h:hp:y5s54a:-:*:*:*:*:*:*:*not specified by NVDRunning onHewlett Packard Enterprise

Remediation

  • Fix · CNA HP Color LaserJet Pro M280-M281 Multifunction Printer series; HP LaserJet Pro MFP M28-M31 Printer series Fixed in 20190419, 20190426

Timeline

  1. 2026-10-02 Threatist record created from CVE-2019-6325
  2. 2026-10-03 Alias added: GHSA-gv4j-7g97-xgmq

References

Advisory 1

  • TI-2019-04492 Memory corruption in HP Color LaserJet Pro M280-M281 Multifunction Printer series; HP… CVSS 3.0HIGH 7.2
  • TI-2019-04489 Cross-site scripting in HP Color LaserJet Pro M280-M281 Multifunction Printer series; HP… CVSS 3.0MEDIUM 6.1
  • TI-2019-04490 Cross-site scripting in HP Color LaserJet Pro M280-M281 Multifunction Printer series; HP… CVSS 3.0MEDIUM 4.8

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences