PT-2017-3112 · Hewlett Packard · Hpe Intelligent Management Center Plat

Rgod · Published 2017-03-07 · Updated 2018-02-17 · CVE-2017-5791

Positive Technologies (AI Summary)

CVSS v3.1

10

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions HPE Intelligent Management Center PLAT version 7.2 E0403P06

Description The issue is related to the doFilter method in the UrlAccessController class, which has weaknesses in its authentication procedure. This can be exploited by a remote attacker to bypass authentication using a specially crafted string in a URI.

Recommendations For HPE Intelligent Management Center PLAT version 7.2 E0403P06, consider restricting access to the UrlAccessController class until a patch is available. As a temporary workaround, avoid using unspecified strings in URI requests to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Improper Authentication

Weakness Enumeration

CWE-287

Related Identifiers

BDU:2017-02510

CVE-2017-5791

ZDI-17-161

Affected Products

Hpe Intelligent Management Center Plat

References · 11

• https://bdu.fstec.ru/vul/2017-02510 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2017-5791 · Security Note
• https://osv.dev/vulnerability/CVE-2017-5791 · Vendor Advisory
• https://h20564.www2.hpe.com/hpsc/doc/public/display?docId=emr_na-hpesbhf03716en_us · Vendor Advisory
• https://zerodayinitiative.com/advisories/ZDI-17-161 · Security Note
• http://zerodayinitiative.com/advisories/ZDI-17-161 · Note
• http://securityfocus.com/bid/96815 · Note
• http://securitytracker.com/id/1037983 · Note
• https://h20566.www2.hpe.com/hpsc/doc/public/display?docLocale=en_US&docId=emr_na-hpesbhf03716en_us · Note
• http://securityfocus.com/bid/101224 · Note
• https://h20566.www2.hpe.com/hpsc/doc/public/display?docLocale=en_US&docId=emr_na-hpesbhf03716en_us · Note