PT-2014-4813 · Hewlett Packard+1 · Hp Executive Scorecard+1

Published 2014-06-18 · Updated 2014-06-26 · CVE-2014-2609

Positive Technologies (AI Summary)

CVSS v2.0

10

High

Base vector

AV:N/AC:L/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions HP Executive Scorecard versions 9.40 through 9.41

Description The Java Glassfish Admin Console does not require authentication, allowing remote attackers to execute arbitrary code via a session on TCP port 10001.

Recommendations For versions 9.40 and 9.41, restrict access to TCP port 10001 to minimize the risk of exploitation. As a temporary workaround, consider disabling the Java Glassfish Admin Console until a patch is available. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Improper Authentication

Weakness Enumeration

CWE-287

Related Identifiers

CVE-2014-2609

ZDI-14-208

Affected Products

Hp Executive Scorecard

Java Glassfish Admin Console

References · 7

• https://nvd.nist.gov/vuln/detail/CVE-2014-2609 · Security Note
• https://h20564.www2.hp.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c04341295 · Vendor Advisory
• https://zerodayinitiative.com/advisories/ZDI-14-208 · Security Note
• http://securitytracker.com/id/1030439 · Note
• http://zerodayinitiative.com/advisories/ZDI-14-208 · Note
• http://secunia.com/advisories/59363 · Note
• http://securityfocus.com/bid/68093 · Note