PT-2013-4488 · Hewlett Packard · Hp System Management Homepage

Markus Wulftange · Publicado 2013-06-14 · Atualizado 2014-01-08 · CVE-2013-3576

Positive Technologies (AI Summary)

CVSS v2.0

9.0

Alta

Vetor base

AV:N/AC:L/Au:S/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions HP System Management Homepage (SMH) (affected versions not specified)

Description The issue allows remote authenticated users to execute arbitrary commands. This is achieved by using shell metacharacters in the PATH INFO to the /smhutil/snmpchp.php endpoint.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

OS Command Injection

Enumeração de Fraquezas

CWE-78

Identificadores relacionados

CVE-2013-3576

Produtos afetados

Hp System Management Homepage

Referências · 5

• 🔥 https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/multi/http/hp_sys_mgmt_exec.rb · Exploit
• 🔥 http://kb.cert.org/vuls/id/735364 · Exploit
• 🔥 https://exploit-db.com/exploits/26420 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2013-3576 · Nota de Segurança
• http://marc.info/?l=bugtraq&m=137952496405683&w=2 · Aviso do Fabricante