HP Intelligent Management Center SOM Module filePath Information Disclosure

High Nessus Plugin ID 99360


A web application hosted on the remote web server is affected by an information disclosure vulnerability.


The HP Intelligent Management Center (IMC) application running on the remote host is affected by an information disclosure vulnerability in the included IMC Service Operation Management (SOM) module, specifically within the FileDownload servlet, due to improper validation of user-supplied input to the 'filePath' parameter. An unauthenticated, remote attacker can exploit this, via a specially crafted request, to disclose the contents of arbitrary files on the system.


Upgrade the HP IMC SOM module to version 7.3 E0501 or later.

See Also



Plugin Details

Severity: High

ID: 99360

File Name: hp_imc_som_cve-2017-5797.nasl

Version: $Revision: 1.2 $

Type: remote

Family: Misc.

Published: 2017/04/13

Modified: 2017/08/15

Dependencies: 71885

Risk Information

Risk Factor: High


Base Score: 7.8

Temporal Score: 6.4

Vector: CVSS2#AV:N/AC:L/Au:N/C:C/I:N/A:N

Temporal Vector: CVSS2#E:F/RL:OF/RC:ND


Base Score: 7.5

Temporal Score: 6.9

Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Temporal Vector: CVSS:3.0/E:F/RL:O/RC:X

Vulnerability Information

CPE: cpe:/a:hp:intelligent_management_center, cpe:/a:hp:imc_service_operation_management_software_module

Required KB Items: installed_sw/HP Intelligent Management Center Web Interface

Exploit Available: true

Exploit Ease: Exploits are available

Exploited by Nessus: true

Patch Publication Date: 2017/03/13

Vulnerability Publication Date: 2017/03/13

Reference Information

CVE: CVE-2017-5797

BID: 97214

OSVDB: 154556

HP: emr_na-hpesbhf03719en_us, HPESBHF03719

ZDI: ZDI-17-192