PT-2017-16690 · Hewlett Packard · Hpe Intelligent Management Center

Published 2017-03-11 · Updated 2018-03-06 · CVE-2017-5795

Positive Technologies (AI Summary)

CVSS v2.0

7.1

High

Base vector

AV:N/AC:M/Au:N/C:C/I:N/A:N

Name of the Vulnerable Software and Affected Versions HPE Intelligent Management Center version PLAT 7.2 E0403P06

Description A Local Arbitrary File Download issue was discovered, which can lead to directory traversal and information disclosure. This issue affects the FileDownloadServlet, potentially allowing unauthorized access to sensitive files.

Recommendations For HPE Intelligent Management Center version PLAT 7.2 E0403P06, consider restricting access to the FileDownloadServlet until a patch is available. As a temporary workaround, limiting the fileName parameter in the FileDownloadServlet may help minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Information Disclosure

Weakness Enumeration

CWE-200

Related Identifiers

CVE-2017-5795

ZDI-17-165

Affected Products

Hpe Intelligent Management Center

References · 5

• https://osv.dev/vulnerability/CVE-2017-5795 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2017-5795 · Security Note
• https://zerodayinitiative.com/advisories/ZDI-17-165 · Security Note
• https://support.hpe.com/hpsc/doc/public/display?docId=emr_na-hpesbhf03714en_us · Vendor Advisory
• http://securityfocus.com/bid/96773 · Note