6.8 - HPSBUX03139 SSRT101608

Executive Summary

This Alert is flagged as TOP 25 Common Weakness Enumeration from CWE/SANS. For more information, you can read this.

Summary
Title	HP-UX running System Management Homepage (SMH), Remote Cross-Site Request Forgery

Informations
Name	HPSBUX03139 SSRT101608	First vendor Publication	2014-10-13
Vendor	HP	Last vendor Modification	2014-10-13
Severity (Vendor)	N/A	Revision	N/A

Security-Database Scoring CVSS v3

Cvss vector : N/A
Overall CVSS Score	NA
Base Score	NA	Environmental Score	NA
impact SubScore	NA	Temporal Score	NA
Exploitabality Sub Score	NA

Calculate full CVSS 3.0 Vectors scores

Security-Database Scoring CVSS v2

Cvss vector : (AV:N/AC:M/Au:N/C:P/I:P/A:P)
Cvss Base Score	6.8	Attack Range	Network
Cvss Impact Score	6.4	Attack Complexity	Medium
Cvss Expoit Score	8.6	Authentication	None Required
Calculate full CVSS 2.0 Vectors scores

Detail

A potential security vulnerability has been identified with HP System Management Homepage (SMH) for HP-UX. The vulnerability could be exploited remotely to allow cross-site request forgery (CSRF).

Original Source

Url : http://h20000.www2.hp.com/bizsupport/TechSupport/Document.jsp?objectID=c04476799

CWE : Common Weakness Enumeration

%	Id	Name
100 %	CWE-352	Cross-Site Request Forgery (CSRF) (CWE/SANS Top 25)

OVAL Definitions

Definition Id: oval:org.mitre.oval:def:27002

Oval ID:	oval:org.mitre.oval:def:27002
Title:	HP-UX running System Management Homepage (SMH), Remote Cross-Site Request Forgery
Description:	Cross-site request forgery (CSRF) vulnerability in HP System Management Homepage (SMH) before 3.2.3 on HP-UX B.11.23, and before 3.2.8 on HP-UX B.11.31, allows remote attackers to hijack the authentication of unspecified victims via unknown vectors.
Family:	unix	Class:	vulnerability
Reference(s):	CVE-2014-7874	Version:	8
Platform(s):	HP-UX 11	Product(s):
Definition Synopsis:
Criteria meets HP Security Bulletin HPSBUX03139 HP-UX B.11.23 AND filesets tests SysMgmtHomepage.SMH-PPAGES version is less than or AND SysMgmtHomepage.SMH-PPAGES-COM version is less than or AND SysMgmtHomepage.SMH-RUN version is less than or AND SysMgmtHomepage.SMH-SAMLOG version is less than or AND SysMgmtHomepage.SMH-UILIB version is less than or AND SysMgmtHomepage.SMH-ASSIST version is less than or AND SysMgmtHomepage.SMH-SDK version is less than or AND SysMgmtHomepage.SMH-UILIB-COM version is less than or AND SysMgmtHomepage.SMH-XLAUNCH version is less than or AND SysMgmtHomepage.SMH-DOC version is less than or AND SysMgmtHomepage.SMH-DOC-COM version is less than or OR Criteria meets HP Security Bulletin HPSBUX03139 HP-UX B.11.31 AND filesets tests SysMgmtHomepage.SMH-PPAGES version is less than or AND SysMgmtHomepage.SMH-ASSIST version is less than or AND SysMgmtHomepage.SMH-DOC version is less than or AND SysMgmtHomepage.SMH-DOC-COM version is less than or AND SysMgmtHomepage.SMH-SDK version is less than or AND SysMgmtHomepage.SMH-PPAGES-COM version is less than or AND SysMgmtHomepage.SMH-RUN version is less than or AND SysMgmtHomepage.SMH-SAMLOG version is less than or AND SysMgmtHomepage.SMH-UILIB version is less than or AND SysMgmtHomepage.SMH-UILIB-COM version is less than or AND SysMgmtHomepage.SMH-XLAUNCH version is less than or

CPE : Common Platform Enumeration

Type	Description	Count
Application	Hp System Management Homepage cpe:2.3:a:hp:system_management_homepage:3.2.7:::::::* cpe:2.3:a:hp:system_management_homepage:3.2.2:::::::* cpe:2.3:a:hp:system_management_homepage:3.0.2.77:::::::* cpe:2.3:a:hp:system_management_homepage:3.0.2.77:b:::::: cpe:2.3:a:hp:system_management_homepage:3.0.2-77:::::::* cpe:2.3:a:hp:system_management_homepage:3.0.2:::::::* cpe:2.3:a:hp:system_management_homepage:3.0.1.73:::::::* cpe:2.3:a:hp:system_management_homepage:3.0.1-73:::::::* cpe:2.3:a:hp:system_management_homepage:3.0.1:::::::* cpe:2.3:a:hp:system_management_homepage:3.0.0.64:::::::* cpe:2.3:a:hp:system_management_homepage:3.0.0-68:::::::* cpe:2.3:a:hp:system_management_homepage:3.0.0:::::::* cpe:2.3:a:hp:system_management_homepage:2.2.8:::::::* cpe:2.3:a:hp:system_management_homepage:2.2.6:::::::* cpe:2.3:a:hp:system_management_homepage:2.1.9-178:::::::* cpe:2.3:a:hp:system_management_homepage:2.1.9:::::::* cpe:2.3:a:hp:system_management_homepage:2.1.8.179:::::::* cpe:2.3:a:hp:system_management_homepage:2.1.8-177:::::::* cpe:2.3:a:hp:system_management_homepage:2.1.8:::::::* cpe:2.3:a:hp:system_management_homepage:2.1.7.168:::::::* cpe:2.3:a:hp:system_management_homepage:2.1.7-168:::::::* cpe:2.3:a:hp:system_management_homepage:2.1.7:::::::* cpe:2.3:a:hp:system_management_homepage:2.1.6.156:::::::* cpe:2.3:a:hp:system_management_homepage:2.1.6-156:::::::* cpe:2.3:a:hp:system_management_homepage:2.1.6:::::::* cpe:2.3:a:hp:system_management_homepage:2.1.5.146:b:::::: cpe:2.3:a:hp:system_management_homepage:2.1.5.146:::::::* cpe:2.3:a:hp:system_management_homepage:2.1.5-146:::::::* cpe:2.3:a:hp:system_management_homepage:2.1.5:::::::* cpe:2.3:a:hp:system_management_homepage:2.1.4.143:::::::* cpe:2.3:a:hp:system_management_homepage:2.1.4-143:::::::* cpe:2.3:a:hp:system_management_homepage:2.1.4:::::::* cpe:2.3:a:hp:system_management_homepage:2.1.3.132:::::::* cpe:2.3:a:hp:system_management_homepage:2.1.3:::::::* cpe:2.3:a:hp:system_management_homepage:2.1.2.127:::::::* cpe:2.3:a:hp:system_management_homepage:2.1.2-127:::::::* cpe:2.3:a:hp:system_management_homepage:2.1.2:::::::* cpe:2.3:a:hp:system_management_homepage:2.1.15.210:::::::* cpe:2.3:a:hp:system_management_homepage:2.1.15-210:::::::* cpe:2.3:a:hp:system_management_homepage:2.1.15:::::::* cpe:2.3:a:hp:system_management_homepage:2.1.14.204:::::::* cpe:2.3:a:hp:system_management_homepage:2.1.14.20:::::::* cpe:2.3:a:hp:system_management_homepage:2.1.14:::::::* cpe:2.3:a:hp:system_management_homepage:2.1.12.201:::::::* cpe:2.3:a:hp:system_management_homepage:2.1.12-200:::::::* cpe:2.3:a:hp:system_management_homepage:2.1.12-118:::::::* cpe:2.3:a:hp:system_management_homepage:2.1.11.197:a:::::: cpe:2.3:a:hp:system_management_homepage:2.1.11-197:::::::* cpe:2.3:a:hp:system_management_homepage:2.1.11:::::::* cpe:2.3:a:hp:system_management_homepage:2.1.10.186:b:::::: cpe:2.3:a:hp:system_management_homepage:2.1.10.186:::::::* cpe:2.3:a:hp:system_management_homepage:2.1.10.186:c:::::: cpe:2.3:a:hp:system_management_homepage:2.1.10-186:::::::* cpe:2.3:a:hp:system_management_homepage:2.1.10:::::::* cpe:2.3:a:hp:system_management_homepage:2.1.1:::::::* cpe:2.3:a:hp:system_management_homepage:2.1.0.121:::::::* cpe:2.3:a:hp:system_management_homepage:2.1.0-118:::::::* cpe:2.3:a:hp:system_management_homepage:2.1.0-109:::::::* cpe:2.3:a:hp:system_management_homepage:2.1.0-103(a):::::::* cpe:2.3:a:hp:system_management_homepage:2.1.0-103:::::::* cpe:2.3:a:hp:system_management_homepage:2.1:::::::* cpe:2.3:a:hp:system_management_homepage:2.0.2.106:::::::* cpe:2.3:a:hp:system_management_homepage:2.0.2:::::::* cpe:2.3:a:hp:system_management_homepage:2.0.1.104:::::::* cpe:2.3:a:hp:system_management_homepage:2.0.1:::::::* cpe:2.3:a:hp:system_management_homepage:2.0.0:::::::* cpe:2.3:a:hp:system_management_homepage:::::::: cpe:2.3:a:hp:system_management_homepage:-:::::::*	68
Os	Hp Hp-Ux cpe:2.3:o:hp:hp-ux:b.11.31:::::::* cpe:2.3:o:hp:hp-ux:b.11.23:::::::*	2

Alert History

If you want to see full details history, please login or register.

Date	Informations
2014-10-23 00:29:14	Multiple Updates
2014-10-19 09:26:41	Multiple Updates
2014-10-14 21:23:12	First insertion

Global Informations

Type	Count
CWE ID(s)	1
Oval ID(s)	1
CPE ID(s)	70

	Related
6.8	CVE-2014-7874
Info : listing not affected by your CVSS Env Score

Same Subject	Severity
Login to view 1 more Alert(s)