HP System Management Homepage < 7.2.0.14 iprange Parameter Code Execution

high Nessus Plugin ID 66541

Language:

Synopsis

The remote web server is affected by a code execution vulnerability.

Description

According to the web server's banner, the version of HP System Management Homepage (SMH) hosted on the remote web server is a version prior to 7.2.0.14 and is, therefore, reportedly affected by a code execution vulnerability related to the 'iprange' parameter in requests made to '/proxy/DataValidation'

Note that successful exploitation requires that anonymous access is enabled.

Solution

Upgrade to HP System Management Homepage 7.2.0.14 or later.

Plugin Details

Severity: High

ID: 66541

File Name: hpsmh_7_2_0_14.nasl

Version: 1.4

Type: remote

Family: Web Servers

Published: 5/22/2013

Updated: 4/11/2022

Configuration: Enable thorough checks

Supported Sensors: Nessus

Vulnerability Information

CPE: cpe:/a:hp:system_management_homepage

Required KB Items: www/hp_smh

Exploit Available: true

Exploit Ease: Exploits are available

Patch Publication Date: 2/19/2013

Vulnerability Publication Date: 3/29/2013

Exploitable With

Metasploit (HP System Management Anonymous Access Code Execution)

Reference Information

BID: 58817

Detections

Analytics