PT-2017-13414 · Hewlett Packard · Hp Arcsight Esm+1

Published 2017-10-31 · Updated 2017-11-18 · CVE-2017-14356

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions HP ArcSight ESM versions prior to 6.9.1c Patch 4 HP ArcSight ESM versions prior to 6.11.0 Patch 1 HP ArcSight ESM Express versions prior to 6.9.1c Patch 4 HP ArcSight ESM Express versions prior to 6.11.0 Patch 1

Description The issue is an SQL Injection vulnerability that could be exploited remotely, allowing SQL injection.

Recommendations For HP ArcSight ESM and HP ArcSight ESM Express versions prior to 6.9.1c Patch 4, update to 6.9.1c Patch 4 or later. For HP ArcSight ESM and HP ArcSight ESM Express versions prior to 6.11.0 Patch 1, update to 6.11.0 Patch 1 or later.

Fix

SQL injection

Weakness Enumeration

CWE-89

Related Identifiers

CVE-2017-14356

Affected Products

Hp Arcsight Esm

Arcsight Esm Express

References · 5

• https://nvd.nist.gov/vuln/detail/CVE-2017-14356 · Security Note
• https://osv.dev/vulnerability/CVE-2017-14356 · Vendor Advisory
• http://securityfocus.com/bid/101627 · Note
• https://auscert.org.au/bulletins/54166 · Note
• https://softwaresupport.hpe.com/km/KM02996760 · Note