KLA10188 Multiple vulnerabilities in HP Insight Diagnostics

Multiple critical vulnerabilities have been found in HP Insight Diagnostics. Malicious users can exploit these vulnerabilities to inject code or write local files. Below is a complete list of vulnerabilities

1. Improper PHP include restrictions can be exploited via a path parameter;
2. A path traversal vulnerability can be exploited remotely via a devicePath parameter;
3. Unknown vectors can be exploited remotely.

Original advisories

Related products

HP-Insight-Diagnostics

CVE list

CVE-2013-3573 critical

CVE-2013-3574 critical

CVE-2013-3575 critical

Solution

Update to latest version

Impacts

• CI

Code injection. Exploitation of vulnerabilities with this impact can lead to changes in target code.

• WLF

Write Local Files. Exploitation of vulnerabilities with this impact can lead to writing into some inaccessible files. Files that can be read depends on concrete program errors.

Affected Products

• HP Insight Diagnostics version 9.4.0.4710