PT-2010-1319 · Hewlett Packard · Hp Power Manager

Alin Rad Pop · Publicado 2010-01-20 · Atualizado 2019-10-09 · CVE-2009-4000

Positive Technologies (AI Summary)

CVSS v2.0

10

Alta

Vetor base

AV:N/AC:L/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions HP Power Manager versions prior to 4.2.10

Description A directory traversal issue exists in the goform/formExportDataLogs component, allowing remote attackers to overwrite arbitrary files and execute arbitrary code by using directory traversal sequences in the fileName parameter.

Recommendations For versions prior to 4.2.10, update to version 4.2.10 or later to resolve the issue. As a temporary workaround, consider restricting access to the goform/formExportDataLogs component to minimize the risk of exploitation. Avoid using the fileName parameter in the affected component until the issue is resolved.

Correção

Path traversal

Enumeração de Fraquezas

CWE-22

Identificadores relacionados

CVE-2009-4000

Produtos afetados

Hp Power Manager

Referências · 6

• http://securityfocus.com/bid/37873 · Nota
• http://secunia.com/secunia_research/2009-48 · Aviso do Fabricante
• http://securitytracker.com/id?1023470 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2009-4000 · Nota de Segurança
• http://secunia.com/advisories/37280 · Aviso do Fabricante
• http://marc.info/?l=bugtraq&m=126393370331959&w=2 · Aviso do Fabricante