PT-2015-2786 · Hewlett Packard · Hp System Management Homepage

Published 2015-07-21 · Updated 2017-09-21 · CVE-2015-2134

Positive Technologies (AI Summary)

CVSS v2.0

6.0

Medium

Base vector

AV:N/AC:M/Au:S/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions HP System Management Homepage versions prior to 7.5.0

Description A cross-site request forgery (CSRF) issue allows remote authenticated users to hijack the authentication of unspecified victims. This can be exploited by a remote attacker to disrupt the authentication procedure of arbitrary users.

Recommendations For HP System Management Homepage versions prior to 7.5.0, update to version 7.5.0 or later to resolve the issue. As a temporary workaround, consider restricting access to the management interface to minimize the risk of exploitation.

Fix

CSRF

Weakness Enumeration

CWE-352

Related Identifiers

BDU:2015-12151

CVE-2015-2134

Affected Products

Hp System Management Homepage

References · 7

• https://bdu.fstec.ru/vul/2015-12151 · Security Note
• http://marc.info/?l=bugtraq&m=144050155601375&w=2 · Vendor Advisory
• https://h20564.www2.hp.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c04746490 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2015-2134 · Security Note
• http://securityfocus.com/bid/75961 · Note
• http://securitytracker.com/id/1033014 · Note
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-2134 · Note