vulnerability bulletin CVE-2012-3259 CVE-2012-3260 CVE-2012-3261

HP SiteScope: six vulnerabilities

Synthesis of the vulnerability

An unauthenticated attacker can use several vulnerabilities of HP SiteScope, in order to execute privileged code.
Impacted products: SiteScope.
Severity: 3/4.
Creation date: 29/08/2012.
Identifiers: BID-55269, BID-55273, c03489683, CERTA-2012-AVI-517, CVE-2012-3259, CVE-2012-3260, CVE-2012-3261, CVE-2012-3262, CVE-2012-3263, CVE-2012-3264, HPSBMU02815, SSRT100715, SSRT100717, SSRT100718, SSRT100719, SSRT100720, VIGILANCE-VUL-11903, ZDI-12-173, ZDI-12-174, ZDI-12-175, ZDI-12-176, ZDI-12-177, ZDI-12-178, ZDI-CAN-1461, ZDI-CAN-1463, ZDI-CAN-1464, ZDI-CAN-1465, ZDI-CAN-1472.

Description of the vulnerability

Six vulnerabilities were announced in HP SiteScope.

An unauthenticated attacker can call the SOAP getSiteScopeConfiguration() function, in order to obtain the administrator password. [severity:3/4; ZDI-12-173]

An unauthenticated attacker can use the UploadFilesHandler url, in order to upload a script on the server. [severity:3/4; BID-55273, ZDI-12-174]

An unauthenticated attacker can call the SOAP create() function, in order to create a new user. [severity:3/4; ZDI-12-175]

An unauthenticated attacker can call the SOAP getFileInternal() function, in order to read the configuration, which contains passwords. [severity:3/4; ZDI-12-176]

An unauthenticated attacker can call the SOAP loadFileContent() function, in order to read configuration files, which contain passwords. [severity:3/4; ZDI-12-177]

An unauthenticated attacker can call the SOAP update() function, in order to change the administrator's password. [severity:3/4; ZDI-12-178]
Complete Vigil@nce bulletin.... (free access)

Share this bulletin

          

Computer vulnerabilities tracking service

Vigil@nce provides networks vulnerabilities alerts. The Vigil@nce team tracks computer vulnerabilities impacting systems and applications. The Vigil@nce vulnerability database contains several thousand vulnerabilities. The technology watch team tracks security threats targeting the computer system.