PT-2010-2211 · Hewlett Packard · Hp Openview Performance Insight

Published 2010-03-09 · Updated 2018-10-10 · CVE-2010-0447

Positive Technologies (AI Summary)

CVSS v2.0

10

High

Base vector

AV:N/AC:L/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions HP OpenView Performance Insight versions 5.4 and earlier

Description The issue concerns improper authentication and validation of requests in the helpmanager servlet of the web server. This allows remote attackers to execute arbitrary commands, specifically through the upload of a JSP document. No information is provided about the estimated number of potentially affected devices or real-world incidents.

Recommendations For HP OpenView Performance Insight versions 5.4 and earlier, consider disabling the helpmanager servlet as a temporary workaround until a patch is available. Restrict access to the upload functionality to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Improper Authentication

Weakness Enumeration

CWE-287

Related Identifiers

CVE-2010-0447

ZDI-10-026

Affected Products

Hp Openview Performance Insight

References · 10

• http://marc.info/?l=bugtraq&m=126815897824020&w=2 · Vendor Advisory
• https://zerodayinitiative.com/advisories/ZDI-10-026 · Security Note
• http://secunia.com/advisories/38899 · Vendor Advisory
• http://vupen.com/english/advisories/2010/0555 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2010-0447 · Security Note
• http://osvdb.org/62797 · Note
• http://securityfocus.com/archive/1/509984/100/0/threaded · Note
• https://exchange.xforce.ibmcloud.com/vulnerabilities/56757 · Note
• http://zerodayinitiative.com/advisories/ZDI-10-026 · Note
• http://securityfocus.com/bid/38611 · Note