PT-2017-13414 · Hewlett Packard · Hp Arcsight Esm+1

Publicado 2017-10-31 · Atualizado 2017-11-18 · CVE-2017-14356

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Crítica

Vetor base

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions HP ArcSight ESM versions prior to 6.9.1c Patch 4 HP ArcSight ESM versions prior to 6.11.0 Patch 1 HP ArcSight ESM Express versions prior to 6.9.1c Patch 4 HP ArcSight ESM Express versions prior to 6.11.0 Patch 1

Description The issue is an SQL Injection vulnerability that could be exploited remotely, allowing SQL injection.

Recommendations For HP ArcSight ESM and HP ArcSight ESM Express versions prior to 6.9.1c Patch 4, update to 6.9.1c Patch 4 or later. For HP ArcSight ESM and HP ArcSight ESM Express versions prior to 6.11.0 Patch 1, update to 6.11.0 Patch 1 or later.

Correção

SQL injection

Enumeração de Fraquezas

CWE-89

Identificadores relacionados

CVE-2017-14356

Produtos afetados

Hp Arcsight Esm

Arcsight Esm Express

Referências · 5

• http://securityfocus.com/bid/101627 · Nota
• https://auscert.org.au/bulletins/54166 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2017-14356 · Nota de Segurança
• https://osv.dev/vulnerability/CVE-2017-14356 · Aviso do Fabricante
• https://softwaresupport.hpe.com/km/KM02996760 · Nota