PT-2017-3008 · Hewlett Packard · Hp Sitescope

Publicado 2017-09-21 · Atualizado 2019-10-03 · CVE-2017-14349

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Crítica

Vetor base

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions HPE SiteScope versions 11.2x through 11.3x

Description The issue is related to inadequate access control in the HPE SiteScope product, allowing read-only accounts to view all SiteScope interfaces and monitors. This could potentially expose sensitive data. An attacker with remote access and read-only privileges may exploit this to view all interfaces and monitors, disclosing confidential information.

Recommendations For HPE SiteScope versions 11.2x through 11.3x, consider restricting access to sensitive data and monitors to minimize the risk of exploitation until a fix is available. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Improper Access Control

Information Disclosure

Improper Privilege Management

Enumeração de Fraquezas

CWE-284

CWE-200

CWE-269

Identificadores relacionados

BDU:2017-02361

CVE-2017-14349

Produtos afetados

Hp Sitescope

Referências · 6

• https://osv.dev/vulnerability/CVE-2017-14349 · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2017-14349 · Nota de Segurança
• https://bdu.fstec.ru/vul/2017-02361 · Nota de Segurança
• https://softwaresupport.hpe.com/km/KM02948051 · Nota
• https://auscert.org.au/bulletins/52758 · Nota
• http://securityfocus.com/bid/100989 · Nota