CVE-2010-1748

CVE-2010-1748 describes an information disclosure vulnerability in the CUPS web interface, specifically affecting Apple Mac OS X 10.5.8, Mac OS X 10.6 before 10.6.4, and other platforms running CUPS before version 1.4.4. The flaw lies in the cgi_initialize_string function's improper handling of malformed URL parameters containing a lone percent character, allowing attackers to extract sensitive information from cupsd process memory. Rated with a CVSS score of 4.3, this vulnerability has a network attack vector and medium attack complexity, requiring no authentication. The primary impact is confidentiality, as it can lead to the disclosure of sensitive data, but does not affect integrity or availability. While not listed on the CISA KEV catalog, an ExploitDB entry (EDB-34152) exists, indicating public exploit code availability. Community discussion and media coverage are minimal, suggesting low widespread attention, despite its elevated FAUCET Risk Score of 84/100.