PT-2013-4486 · Hewlett Packard · Hp Insight Diagnostics

Markus Wulftange · Publicado 2013-06-14 · Atualizado 2013-06-14 · CVE-2013-3574

Positive Technologies (AI Summary)

CVSS v2.0

7.8

Alta

Vetor base

AV:N/AC:L/Au:N/C:N/I:C/A:N

Name of the Vulnerable Software and Affected Versions HP Insight Diagnostics version 9.4.0.4710

Description The issue allows remote attackers to write data to arbitrary files via a full pathname in the argument to the devicePath (also known as mount) parameter in the saveCompareConfig.php file. This is an absolute path traversal vulnerability.

Recommendations For HP Insight Diagnostics version 9.4.0.4710, avoid using the devicePath parameter with full pathnames in the saveCompareConfig.php file until a fix is available. As a temporary workaround, consider restricting access to the saveCompareConfig.php file to minimize the risk of exploitation.

Exploit

Correção

RCE

Enumeração de Fraquezas

CWE-20

Identificadores relacionados

CVE-2013-3574

Produtos afetados

Hp Insight Diagnostics

Referências · 3

• 🔥 https://exploit-db.com/exploits/38562 · Exploit
• http://kb.cert.org/vuls/id/324668 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2013-3574 · Nota de Segurança