PT-2014-4814 · Hewlett Packard · Content Acceleration Pack+1

Published 2014-06-18 · Updated 2014-06-26 · CVE-2014-2610

Positive Technologies (AI Summary)

CVSS v2.0

7.1

High

Base vector

AV:N/AC:H/Au:S/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions HP Executive Scorecard versions 9.40 through 9.41

Description The issue allows remote authenticated users to execute arbitrary code by uploading an executable file due to a directory traversal vulnerability in the Content Acceleration Pack (CAP) web application.

Recommendations For versions 9.40 and 9.41, consider restricting access to the file upload functionality in the CAP web application until a fix is available. As a temporary workaround, disabling the executable file upload feature can help minimize the risk of exploitation.

Fix

Path traversal

Weakness Enumeration

CWE-22

Related Identifiers

CVE-2014-2610

ZDI-14-209

Affected Products

Content Acceleration Pack

Hp Executive Scorecard

References · 7

• https://zerodayinitiative.com/advisories/ZDI-14-209 · Security Note
• https://h20564.www2.hp.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c04341295 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2014-2610 · Security Note
• http://securitytracker.com/id/1030439 · Note
• http://secunia.com/advisories/59363 · Note
• http://securityfocus.com/bid/68093 · Note
• http://zerodayinitiative.com/advisories/ZDI-14-209 · Note