Lucene search

[email protected]CVE-2017-13988

HistorySep 30, 2017 - 1:29 a.m.

CVE-2017-13988

2017-09-3001:29:00

NVD-CWE-noinfo

[email protected]

web.nvd.nist.gov

cve-2017-13988

arcsight esm

arcsight esm express

access control

vulnerability

security

unauthorized access

storage groups

follow schedule

6.5 Medium

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

NONE

Integrity Impact

HIGH

Availability Impact

NONE

CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N

6.8 Medium

AI Score

Confidence

Low

4 Medium

CVSS2

Access Vector

NETWORK

Access Complexity

LOW

Authentication

SINGLE

Confidentiality Impact

NONE

Integrity Impact

PARTIAL

Availability Impact

NONE

AV:N/AC:L/Au:S/C:N/I:P/A:N

0.001 Low

EPSS

Percentile

20.8%

JSON

An improper access control vulnerability in ArcSight ESM and ArcSight ESM Express, any 6.x version prior to 6.9.1c Patch 4 or 6.11.0 Patch 1, allows unauthorized users to alter the maximum size of storage groups and enable/disable the setting for the ‘follow schedule’ function.

CPENameOperatorVersion
hp:arcsight_enterprise_security_managerhp arcsight enterprise security managereq6.8
hp:arcsight_enterprise_security_managerhp arcsight enterprise security managereq6.5
hp:arcsight_enterprise_security_managerhp arcsight enterprise security managereq6.0
hp:arcsight_enterprise_security_managerhp arcsight enterprise security managereq6.11.0
hp:arcsight_enterprise_security_managerhp arcsight enterprise security managereq6.0c
hp:arcsight_enterprise_security_managerhp arcsight enterprise security managereq6.5c
hp:arcsight_enterprise_security_managerhp arcsight enterprise security managereq6.8c
hp:arcsight_enterprise_security_managerhp arcsight enterprise security managereq6.9.0c
hp:arcsight_enterprise_security_managerhp arcsight enterprise security managereq6.9.1c
hp:arcsight_enterprise_security_manager_expresshp arcsight enterprise security manager expresseq6.11.0

CPE	Name	Operator	Version
hp:arcsight_enterprise_security_manager	hp arcsight enterprise security manager	eq	6.8
hp:arcsight_enterprise_security_manager	hp arcsight enterprise security manager	eq	6.5
hp:arcsight_enterprise_security_manager	hp arcsight enterprise security manager	eq	6.0
hp:arcsight_enterprise_security_manager	hp arcsight enterprise security manager	eq	6.11.0
hp:arcsight_enterprise_security_manager	hp arcsight enterprise security manager	eq	6.0c
hp:arcsight_enterprise_security_manager	hp arcsight enterprise security manager	eq	6.5c
hp:arcsight_enterprise_security_manager	hp arcsight enterprise security manager	eq	6.8c
hp:arcsight_enterprise_security_manager	hp arcsight enterprise security manager	eq	6.9.0c
hp:arcsight_enterprise_security_manager	hp arcsight enterprise security manager	eq	6.9.1c
hp:arcsight_enterprise_security_manager_express	hp arcsight enterprise security manager express	eq	6.11.0

Rows per page:

1-10 of 181

References

www.securityfocus.com/bid/100935

softwaresupport.hpe.com/km/KM02944672

6.5 Medium

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

NONE

Integrity Impact

HIGH

Availability Impact

NONE

CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N

6.8 Medium

AI Score

Confidence

Low

4 Medium

CVSS2

Access Vector

NETWORK

Access Complexity

LOW

Authentication

SINGLE

Confidentiality Impact

NONE

Integrity Impact

PARTIAL

Availability Impact

NONE

AV:N/AC:L/Au:S/C:N/I:P/A:N

0.001 Low

EPSS

Percentile

20.8%

JSON

Related for CVE-2017-13988

cvelist1 prion1 nessus1