Detections
Analytics
HP Intelligent Management Center Branch Intelligent Management Module Multiple Vulnerabilities
critical Nessus Plugin ID 71891
Language:
Synopsis
The version of the HP Branch Intelligent Management System module on the remote host is affected by multiple vulnerabilities.Description
The version of the HP Intelligent Management Center Branch Intelligent Management System module on the remote host is a version prior to 5.2 E0401 and is potentially affected by multiple vulnerabilities :- The 'bimsDownload' servlet is not protected by authentication and could be used to access any file on the system remotely. (CVE-2013-4823)
- The 'UploadServlet' in the BIM module allows unauthenticated users to remotely upload arbitrary files to specific locations on the host. (CVE-2013-4822)
Solution
Upgrade the iMC BIMs module to version 5.2 E0401 or later.See Also
https://www.zerodayinitiative.com/advisories/ZDI-13-238/
Plugin Details
Severity: Critical
ID: 71891
File Name: hp_imc_bims_52_e401.nasl
Version: 1.8
Type: remote
Family: Misc.
Published: 1/9/2014
Updated: 4/11/2022
Configuration: Enable thorough checks
Supported Sensors: Nessus
Risk Information
VPR
Risk Factor: High
Score: 7.4
CVSS v2
Risk Factor: Critical
Base Score: 10
Temporal Score: 8.3
Vector: CVSS2#AV:N/AC:L/Au:N/C:C/I:C/A:C
Vulnerability Information
CPE: cpe:/a:hp:intelligent_management_center
Exploit Available: true
Exploit Ease: Exploits are available
Patch Publication Date: 9/30/2013
Vulnerability Publication Date: 10/8/2013
Exploitable With
Metasploit (HP Intelligent Management Center BIMS UploadServlet Directory Traversal)
Elliot (HP Intelligent Management Center BIMS UploadServlet File Upload)
Reference Information
CVE: CVE-2013-4822, CVE-2013-4823