HP Intelligent Management Center SOM Module Information Disclosure

High Nessus Plugin ID 71888

Synopsis

A web application hosted on the remote web server is affected by an information disclosure vulnerability.

Description

The HP Intelligent Management Center (IMC) application running on the remote host is affected by an information disclosure vulnerability in the included IMC Service Operation Management (SOM) Module, specifically within the FileDownload servlet, due to a failure to require authentication. An unauthenticated, remote attacker can exploit this, via a specially crafted request, to disclose the contents of arbitrary files on the system.

Note that HP IMC is reportedly affected by additional vulnerabilities;
however, Nessus has not tested for these.

Solution

Upgrade the HP IMC SOM Module to version 7.0 E0101 or later.

See Also

http://www.nessus.org/u?e81620e7

https://www.zerodayinitiative.com/advisories/ZDI-13-242/

Plugin Details

Severity: High

ID: 71888

File Name: hp_imc_web_som_file_download.nasl

Version: 1.6

Type: remote

Family: Misc.

Published: 2014/01/09

Updated: 2018/11/15

Dependencies: 71885

Risk Information

Risk Factor: High

CVSS v2.0

Base Score: 7.8

Temporal Score: 5.8

Vector: CVSS2#AV:N/AC:L/Au:N/C:C/I:N/A:N

Temporal Vector: CVSS2#E:U/RL:OF/RC:C

Vulnerability Information

CPE: cpe:/a:hp:intelligent_management_center, cpe:/a:hp:imc_service_operation_management_software_module

Required KB Items: installed_sw/HP Intelligent Management Center Web Interface

Exploit Available: false

Exploit Ease: No known exploits are available

Exploited by Nessus: true

Patch Publication Date: 2013/10/08

Vulnerability Publication Date: 2013/10/08

Reference Information

CVE: CVE-2013-4826

BID: 62898

HP: emr_na-c03943547, HPSBGN02930, SSRT101024

ZDI: ZDI-13-242