PT-2013-4487 · Hewlett Packard · Hp Insight Diagnostics

Markus Wulftange · Publicado 2013-06-14 · Atualizado 2013-06-14 · CVE-2013-3575

Positive Technologies (AI Summary)

CVSS v2.0

5.0

Média

Vetor base

AV:N/AC:L/Au:N/C:N/I:P/A:N

Name of the Vulnerable Software and Affected Versions HP Insight Diagnostics version 9.4.0.4710

Description The issue is related to the improper restriction of PHP include or require statements in the hpdiags/frontend2/help/pageview.php file. This allows remote attackers to include arbitrary .html files via the path parameter.

Recommendations For HP Insight Diagnostics version 9.4.0.4710, consider restricting access to the hpdiags/frontend2/help/pageview.php file until a patch is available. As a temporary workaround, avoid using the path parameter in the affected file to minimize the risk of exploitation.

Exploit

Correção

RCE

Enumeração de Fraquezas

CWE-20

Identificadores relacionados

CVE-2013-3575

Produtos afetados

Hp Insight Diagnostics

Referências · 3

• 🔥 https://exploit-db.com/exploits/38563 · Exploit
• http://kb.cert.org/vuls/id/324668 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2013-3575 · Nota de Segurança