PT-2017-16690 · Hewlett Packard · Hpe Intelligent Management Center

Publicado 2017-03-11 · Atualizado 2018-03-06 · CVE-2017-5795

Positive Technologies (AI Summary)

CVSS v2.0

7.1

Alta

Vetor base

AV:N/AC:M/Au:N/C:C/I:N/A:N

Name of the Vulnerable Software and Affected Versions HPE Intelligent Management Center version PLAT 7.2 E0403P06

Description A Local Arbitrary File Download issue was discovered, which can lead to directory traversal and information disclosure. This issue affects the FileDownloadServlet, potentially allowing unauthorized access to sensitive files.

Recommendations For HPE Intelligent Management Center version PLAT 7.2 E0403P06, consider restricting access to the FileDownloadServlet until a patch is available. As a temporary workaround, limiting the fileName parameter in the FileDownloadServlet may help minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Information Disclosure

Enumeração de Fraquezas

CWE-200

Identificadores relacionados

CVE-2017-5795

ZDI-17-165

Produtos afetados

Hpe Intelligent Management Center

Referências · 5

• https://osv.dev/vulnerability/CVE-2017-5795 · Aviso do Fabricante
• http://securityfocus.com/bid/96773 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2017-5795 · Nota de Segurança
• https://zerodayinitiative.com/advisories/ZDI-17-165 · Nota de Segurança
• https://support.hpe.com/hpsc/doc/public/display?docId=emr_na-hpesbhf03714en_us · Aviso do Fabricante