https://support.hpe.com/hpsc/doc/public/display?docLocale=en_US&docId=emr_na-hpesbhf03930en_us

The HPE Intelligent Management Center (iMC) dbman process running on the remote host is affected by multiple vulnerabilities:

  - A denial of service (DoS) vulnerability exists due to improper     validation of user-supplied data. An unauthenticated, remote     attacker can exploit this issue, via a command 10014 request, to     cause the dbman process to restart. (CVE-2018-7123)

  - A denial of service (DoS) vulnerability exists due to improper     validation of user-supplied data. An unauthenticated, remote     attacker can exploit this issue, via a command 10003 request, to     cause the dbman process to stop responding. (CVE-2019-5355)

  - A command injection vulnerability exists due to improper     validation of user-supplied data. An unauthenticated, remote     attacker can exploit this, via a series of specially crafted     requests, to execute arbitrary commands. (CVE-2019-5390)

  - A stack-based buffer overflow condition exists due to improper     validation of user-supplied data. An unauthenticated, remote     attacker can exploit this, via a series of specially crafted     requests, to cause a denial of service condition or the execution     of arbitrary code. (CVE-2019-5391)

  - An information disclosure vulnerability exists due to improper     validation of user-supplied data. An unauthenticated, remote     attacker can exploit this, via a command 10001 request, to     disclose potentially sensitive information. (CVE-2019-5392)

  - An information disclosure vulnerability exists due to improper     validation of user-supplied data. An unauthenticated, remote     attacker can exploit this, via a command 10002 request, to     backup iMC database files to a directory that allows     unauthenticated access over HTTP. (CVE-2019-5393)

Note that the HPE iMC running on the remote host is reportedly affected by additional vulnerabilities; however, this plugin has not tested for these.

CVE-2018-7123

high

Tenable Plugins

critical