SB2017093006 - Multiple vulnerabilities in UCMDB Configuration Manager

Description

This security bulletin contains information about 2 secuirty vulnerabilities.

1) Input validation error (CVE-ID: CVE-2017-14351)

The vulnerability allows a remote non-authenticated attacker to execute arbitrary code.

A potential security vulnerability has been identified in HP UCMDB Configuration Manager versions 10.10, 10.11, 10.20, 10.21, 10.22, 10.23. These vulnerabilities could be remotely exploited to allow code execution.

2) Cross-site scripting (CVE-ID: CVE-2017-14352)

The vulnerability allows a remote non-authenticated attacker to read and manipulate data.

A potential security vulnerability has been identified in HP UCMDB Configuration Manager versions 10.10, 10.11, 10.20, 10.21, 10.22, 10.23. These vulnerabilities could be remotely exploited to allow cross-site scripting.

Remediation

Install update from vendor's website.

References

• https://softwaresupport.hpe.com/km/KM02968622
• https://www.tenable.com/security/research/tra-2017-32
• http://www.securityfocus.com/bid/101154