PT-2017-16691 · Hewlett Packard · Hpe Intelligent Management Center

Published 2017-03-29 · Updated 2018-03-15 · CVE-2017-5797

Positive Technologies (AI Summary)

CVSS v2.0

7.8

High

Base vector

AV:N/AC:L/Au:N/C:C/I:N/A:N

Name of the Vulnerable Software and Affected Versions HPE Intelligent Management Center (IMC) SOM version v7.3 (E0501)

Description A Remote Unauthenticated Disclosure of Information issue was discovered, potentially allowing unauthorized access to sensitive information. The vulnerability is related to the FileDownloadServlet in the Service Operation Manager Module, which may disclose the filePath information.

Recommendations For HPE Intelligent Management Center (IMC) SOM version v7.3 (E0501), consider restricting access to the FileDownloadServlet until a patch is available. As a temporary workaround, avoid using the filePath parameter in the affected API endpoint to minimize the risk of exploitation.

Fix

Information Disclosure

Weakness Enumeration

CWE-200

Related Identifiers

CVE-2017-5797

ZDI-17-192

Affected Products

Hpe Intelligent Management Center

References · 5

• https://support.hpe.com/hpsc/doc/public/display?docId=emr_na-hpesbhf03719en_us · Vendor Advisory
• https://zerodayinitiative.com/advisories/ZDI-17-192 · Security Note
• https://osv.dev/vulnerability/CVE-2017-5797 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2017-5797 · Security Note
• http://securityfocus.com/bid/97214 · Note