PT-2017-3008 · Hewlett Packard · Hp Sitescope

Published 2017-09-21 · Updated 2019-10-03 · CVE-2017-14349

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions HPE SiteScope versions 11.2x through 11.3x

Description The issue is related to inadequate access control in the HPE SiteScope product, allowing read-only accounts to view all SiteScope interfaces and monitors. This could potentially expose sensitive data. An attacker with remote access and read-only privileges may exploit this to view all interfaces and monitors, disclosing confidential information.

Recommendations For HPE SiteScope versions 11.2x through 11.3x, consider restricting access to sensitive data and monitors to minimize the risk of exploitation until a fix is available. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Improper Access Control

Information Disclosure

Improper Privilege Management

Weakness Enumeration

CWE-284

CWE-200

CWE-269

Related Identifiers

BDU:2017-02361

CVE-2017-14349

Affected Products

Hp Sitescope

References · 6

• https://osv.dev/vulnerability/CVE-2017-14349 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2017-14349 · Security Note
• https://bdu.fstec.ru/vul/2017-02361 · Security Note
• https://softwaresupport.hpe.com/km/KM02948051 · Note
• https://auscert.org.au/bulletins/52758 · Note
• http://securityfocus.com/bid/100989 · Note