PT-2015-1333 · Hewlett Packard · Hp Network Virtualization

Aniway.Anyway · Publicado 2015-05-12 · Atualizado 2016-12-03 · CVE-2015-2121

Positive Technologies (AI Summary)

CVSS v2.0

7.8

Alta

Vetor base

AV:N/AC:L/Au:N/C:C/I:N/A:N

Name of the Vulnerable Software and Affected Versions HP Network Virtualization for LoadRunner and Performance Center versions 8.61 and 11.52

Description The issue allows remote attackers to read arbitrary files via a crafted filename in a URL to the (1) HttpServlet or (2) NetworkEditorController component. This can be exploited by a remote attacker to access sensitive information.

Recommendations For versions 8.61 and 11.52, consider restricting access to the HttpServlet and NetworkEditorController components until a patch is available. As a temporary workaround, avoid using specially crafted URLs that could exploit this issue in the affected components. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Information Disclosure

Enumeração de Fraquezas

CWE-200

Identificadores relacionados

BDU:2015-10421

CVE-2015-2121

ZDI-15-192

Produtos afetados

Hp Network Virtualization

Referências · 6

• https://h20564.www2.hp.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c04657310 · Aviso do Fabricante
• http://zerodayinitiative.com/advisories/ZDI-15-192 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2015-2121 · Nota de Segurança
• https://bdu.fstec.ru/vul/2015-10421 · Nota de Segurança
• http://securityfocus.com/bid/74583 · Nota
• https://zerodayinitiative.com/advisories/ZDI-15-192 · Nota de Segurança