PT-2014-4814 · Hewlett Packard · Content Acceleration Pack+1

Publicado 2014-06-18 · Atualizado 2014-06-26 · CVE-2014-2610

Positive Technologies (AI Summary)

CVSS v2.0

7.1

Alta

Vetor base

AV:N/AC:H/Au:S/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions HP Executive Scorecard versions 9.40 through 9.41

Description The issue allows remote authenticated users to execute arbitrary code by uploading an executable file due to a directory traversal vulnerability in the Content Acceleration Pack (CAP) web application.

Recommendations For versions 9.40 and 9.41, consider restricting access to the file upload functionality in the CAP web application until a fix is available. As a temporary workaround, disabling the executable file upload feature can help minimize the risk of exploitation.

Correção

Path traversal

Enumeração de Fraquezas

CWE-22

Identificadores relacionados

CVE-2014-2610

ZDI-14-209

Produtos afetados

Content Acceleration Pack

Hp Executive Scorecard

Referências · 7

• http://securitytracker.com/id/1030439 · Nota
• https://zerodayinitiative.com/advisories/ZDI-14-209 · Nota de Segurança
• http://secunia.com/advisories/59363 · Nota
• https://h20564.www2.hp.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c04341295 · Aviso do Fabricante
• http://securityfocus.com/bid/68093 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2014-2610 · Nota de Segurança
• http://zerodayinitiative.com/advisories/ZDI-14-209 · Nota