HP WebInspect XXE Unauthorized Information Disclosure

medium Nessus Plugin ID 84194

Language:

Synopsis

A web security application on the remote host is affected by an unauthorized information disclosure vulnerability.

Description

The version of HP WebInspect installed on the remote Windows host is affected by an unauthorized information disclosure vulnerability due to an XML external entity injection flaw that is triggered during the parsing of XML data. A remote attacker can exploit this, via a malicious website scanned by HP WebInspect, to read arbitrary system files.

Solution

Upgrade to HP WebInspect version 10.40.282.10 (10.4 Software Update 1) or later.

Note that HP has not yet made this update generally available via SmartUpdate, and you must contact HP Support directly for the fix.

Plugin Details

Severity: Medium

ID: 84194

File Name: hp_webinspect_SSRT102038.nasl

Version: 1.8

Type: local

Agent: windows

Family: Windows

Published: 6/15/2015

Updated: 11/22/2019

Supported Sensors: Nessus Agent, Nessus

Risk Information

VPR

Risk Factor: Medium

Score: 4.2

CVSS v2

Risk Factor: Medium

Base Score: 4

Temporal Score: 3.1

Vector: CVSS2#AV:N/AC:L/Au:S/C:P/I:N/A:N

CVSS Score Source: CVE-2015-2125

Vulnerability Information

CPE: cpe:/a:hp:web_inspect

Required KB Items: installed_sw/HP WebInspect

Exploit Available: true

Exploit Ease: Exploits are available

Patch Publication Date: 6/3/2015

Vulnerability Publication Date: 6/3/2015

Reference Information

CVE: CVE-2015-2125

BID: 75036

HP: HPSBGN03343, SSRT102038, emr_na-c04695307

Detections

Analytics