Cross-site scripting (XSS) vulnerability in HP Intelligent Management Center (iMC) and Intelligent Management Center for Automated Network Manager (ANM) before 5.2 E0401 allows remote authenticated users to inject arbitrary web script or HTML via unspecified vectors.

Versions of HP Intelligent Management Center less than 5.2 E0401 are potentially affected by the following vulnerabilities :

  - A cross-site scripting vulnerability exists in the 'opentopo_symbolid' parameter of the 'topoContent.jsf' script. (CVE-2012-5200)

  - Multiple code execution vulnerabilities exist. (CVE-2012-5201, CVE-2012-5209)

  - Multiple information disclosure vulnerabilities exist. (CVE-2012-5202, CVE-2012-5203, CVE-2012-5204, CVE-2012-5205, CVE-2012-5206, CVE-2012-5207, CVE-2012-5208, CVE-2012-5212, CVE-2012-5213)

The version of HP Intelligent Management Center running on the remote host is potentially affected by multiple vulnerabilities :

  - A cross-site scripting vulnerability exists in the     'opentopo_symbolid' parameter of the 'topoContent.jsf'     script. (CVE-2012-5200)

  - Multiple code execution vulnerabilities exist.
    (CVE-2012-5201, CVE-2012-5209)

  - Multiple information disclosure vulnerabilities exist.
    (CVE-2012-5202, CVE-2012-5203, CVE-2012-5204,      CVE-2012-5205, CVE-2012-5206, CVE-2012-5207,      CVE-2012-5208, CVE-2012-5212, CVE-2012-5213)

ID	Name	Product	Family	Type	Severity
6779	HP Intelligent Management Center < 5.2 E0401 Multiple Vulnerabilities	Nessus Network Monitor	Generic		critical
65255	HP Intelligent Management Center < 5.2 E401 Multiple Vulnerabilities	Nessus	Gain a shell remotely	Remote	critical

Detections

Analytics

CVE-2012-5200

medium

Tenable Plugins

critical

critical