PT-2017-16693 · Hewlett Packard · Hpe Network Automation

Published 2017-05-11 · Updated 2018-03-07 · CVE-2017-5811

Positive Technologies (AI Summary)

CVSS v2.0

7.8

High

Base vector

AV:N/AC:L/Au:N/C:C/I:N/A:N

Name of the Vulnerable Software and Affected Versions HPE Network Automation versions 9.1x through 10.2x

Description A remote code execution vulnerability was found in HPE Network Automation. The issue allows for directory traversal and information disclosure through the TrueControl Management Engine Service FileServlet.

Recommendations For versions 9.1x through 10.2x, update to a version that contains a fix for this issue, as the current versions are affected by the remote code execution vulnerability.

Fix

Information Disclosure

Weakness Enumeration

CWE-200

Related Identifiers

CVE-2017-5811

ZDI-17-330

Affected Products

Hpe Network Automation

References · 6

• https://support.hpe.com/hpsc/doc/public/display?docId=emr_na-hpesbgn03740en_us · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2017-5811 · Security Note
• https://osv.dev/vulnerability/CVE-2017-5811 · Vendor Advisory
• https://zerodayinitiative.com/advisories/ZDI-17-330 · Security Note
• http://securityfocus.com/bid/98331 · Note
• http://securitytracker.com/id/1038407 · Note