PT-2010-2211 · Hewlett Packard · Hp Openview Performance Insight

Publicado 2010-03-09 · Atualizado 2018-10-10 · CVE-2010-0447

Positive Technologies (AI Summary)

CVSS v2.0

10

Alta

Vetor base

AV:N/AC:L/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions HP OpenView Performance Insight versions 5.4 and earlier

Description The issue concerns improper authentication and validation of requests in the helpmanager servlet of the web server. This allows remote attackers to execute arbitrary commands, specifically through the upload of a JSP document. No information is provided about the estimated number of potentially affected devices or real-world incidents.

Recommendations For HP OpenView Performance Insight versions 5.4 and earlier, consider disabling the helpmanager servlet as a temporary workaround until a patch is available. Restrict access to the upload functionality to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Improper Authentication

Enumeração de Fraquezas

CWE-287

Identificadores relacionados

CVE-2010-0447

ZDI-10-026

Produtos afetados

Hp Openview Performance Insight

Referências · 10

• http://marc.info/?l=bugtraq&m=126815897824020&w=2 · Aviso do Fabricante
• http://osvdb.org/62797 · Nota
• https://zerodayinitiative.com/advisories/ZDI-10-026 · Nota de Segurança
• http://secunia.com/advisories/38899 · Aviso do Fabricante
• http://securityfocus.com/archive/1/509984/100/0/threaded · Nota
• http://vupen.com/english/advisories/2010/0555 · Aviso do Fabricante
• https://exchange.xforce.ibmcloud.com/vulnerabilities/56757 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2010-0447 · Nota de Segurança
• http://zerodayinitiative.com/advisories/ZDI-10-026 · Nota
• http://securityfocus.com/bid/38611 · Nota