PT-2015-1333 · Hewlett Packard · Hp Network Virtualization

Aniway.Anyway · Published 2015-05-12 · Updated 2016-12-03 · CVE-2015-2121

Positive Technologies (AI Summary)

CVSS v2.0

7.8

High

Base vector

AV:N/AC:L/Au:N/C:C/I:N/A:N

Name of the Vulnerable Software and Affected Versions HP Network Virtualization for LoadRunner and Performance Center versions 8.61 and 11.52

Description The issue allows remote attackers to read arbitrary files via a crafted filename in a URL to the (1) HttpServlet or (2) NetworkEditorController component. This can be exploited by a remote attacker to access sensitive information.

Recommendations For versions 8.61 and 11.52, consider restricting access to the HttpServlet and NetworkEditorController components until a patch is available. As a temporary workaround, avoid using specially crafted URLs that could exploit this issue in the affected components. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Information Disclosure

Weakness Enumeration

CWE-200

Related Identifiers

BDU:2015-10421

CVE-2015-2121

ZDI-15-192

Affected Products

Hp Network Virtualization

References · 6

• https://h20564.www2.hp.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c04657310 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2015-2121 · Security Note
• https://bdu.fstec.ru/vul/2015-10421 · Security Note
• https://zerodayinitiative.com/advisories/ZDI-15-192 · Security Note
• http://zerodayinitiative.com/advisories/ZDI-15-192 · Note
• http://securityfocus.com/bid/74583 · Note