PT-2010-1319 · Hewlett Packard · Hp Power Manager

Alin Rad Pop · Published 2010-01-20 · Updated 2019-10-09 · CVE-2009-4000

Positive Technologies (AI Summary)

CVSS v2.0

10

High

Base vector

AV:N/AC:L/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions HP Power Manager versions prior to 4.2.10

Description A directory traversal issue exists in the goform/formExportDataLogs component, allowing remote attackers to overwrite arbitrary files and execute arbitrary code by using directory traversal sequences in the fileName parameter.

Recommendations For versions prior to 4.2.10, update to version 4.2.10 or later to resolve the issue. As a temporary workaround, consider restricting access to the goform/formExportDataLogs component to minimize the risk of exploitation. Avoid using the fileName parameter in the affected component until the issue is resolved.

Fix

Path traversal

Weakness Enumeration

CWE-22

Related Identifiers

CVE-2009-4000

Affected Products

Hp Power Manager

References · 6

• http://secunia.com/secunia_research/2009-48 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2009-4000 · Security Note
• http://secunia.com/advisories/37280 · Vendor Advisory
• http://marc.info/?l=bugtraq&m=126393370331959&w=2 · Vendor Advisory
• http://securityfocus.com/bid/37873 · Note
• http://securitytracker.com/id?1023470 · Note