HP StorageWorks P2000 G3 contains a directory traversal vulnerability which may allow a remote, unauthenticated attacker to obtain sensitive information.
HP StorageWorks P2000 G3 contains an embedded webserver which is vulnerable to a directory traversal vulnerability which may allow a remote, unauthenticated attacker to obtain sensitive information.
This vulnerability was also reported to ZDI by another researcher and was disclosed publicly.
A remote unauthenticated attacker could obtain sensitive information.
The vendor has reported this issue has been addressed in the TS230P008 firmware.
As a general good security practice, only allow connections from trusted hosts and networks. Note that restricting access does not prevent XSS or CSRF attacks since the attack comes as an HTTP request from a legitimate user's host. Restricting access would prevent an attacker from accessing a HP StorageWorks P2000 G3 using stolen credentials from a blocked network location.
Filter by status: All Affected Not Affected Unknown
Filter by content: __ Additional information available
__ Sort by: Status Alphabetical
Notified: November 18, 2011 Updated: March 02, 2012
We have not received a statement from the vendor.
We are not aware of further vendor information regarding this vulnerability.
Group | Score | Vector
Base | 0 | AV:--/AC:--/Au:--/C:--/I:--/A:--
Temporal | 0 | E:ND/RL:ND/RC:ND
Environmental | 0 | CDP:ND/TD:ND/CR:ND/IR:ND/AR:ND
Thanks to Thomas Leonardo of The Cooperative Bank for reporting this vulnerability.
This document was written by Michael Orlando.
CVE IDs: | CVE-2011-4788
Date Public: | 2012-01-13
Date First Published: | 2012-02-20
Date Last Updated: | 2012-03-02 12:57 UTC
Document Revision: | 12