PT-2014-4813 · Hewlett Packard+1 · Hp Executive Scorecard+1

Publicado 2014-06-18 · Atualizado 2014-06-26 · CVE-2014-2609

Positive Technologies (AI Summary)

CVSS v2.0

10

Alta

Vetor base

AV:N/AC:L/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions HP Executive Scorecard versions 9.40 through 9.41

Description The Java Glassfish Admin Console does not require authentication, allowing remote attackers to execute arbitrary code via a session on TCP port 10001.

Recommendations For versions 9.40 and 9.41, restrict access to TCP port 10001 to minimize the risk of exploitation. As a temporary workaround, consider disabling the Java Glassfish Admin Console until a patch is available. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Improper Authentication

Enumeração de Fraquezas

CWE-287

Identificadores relacionados

CVE-2014-2609

ZDI-14-208

Produtos afetados

Hp Executive Scorecard

Java Glassfish Admin Console

Referências · 7

• http://securitytracker.com/id/1030439 · Nota
• http://zerodayinitiative.com/advisories/ZDI-14-208 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2014-2609 · Nota de Segurança
• http://secunia.com/advisories/59363 · Nota
• https://h20564.www2.hp.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c04341295 · Aviso do Fabricante
• http://securityfocus.com/bid/68093 · Nota
• https://zerodayinitiative.com/advisories/ZDI-14-208 · Nota de Segurança