Lucene search

K
zdiAndrea Micalizzi aka rgodZDI-14-100
HistoryApr 17, 2014 - 12:00 a.m.

Hewlett-Packard Virtual User Generator EmulationAdmin Service Information Disclosure Vulnerability

2014-04-1700:00:00
Andrea Micalizzi aka rgod
www.zerodayinitiative.com
12

10 High

CVSS2

Access Vector

NETWORK

Access Complexity

LOW

Authentication

NONE

Confidentiality Impact

COMPLETE

Integrity Impact

COMPLETE

Availability Impact

COMPLETE

AV:N/AC:L/Au:N/C:C/I:C/A:C

0.912 High

EPSS

Percentile

98.9%

This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of HP Virtual User Generator. Authentication is not required to exploit this vulnerability. The specific flaw exists within the exposed EmulationAdminSoapBinding web service. The issue lies in the handling of several methods resulting in the ability to read, write, and delete arbitrary files. An attacker can leverage this vulnerability to leak credential databases or execute code under the context of SYSTEM.

10 High

CVSS2

Access Vector

NETWORK

Access Complexity

LOW

Authentication

NONE

Confidentiality Impact

COMPLETE

Integrity Impact

COMPLETE

Availability Impact

COMPLETE

AV:N/AC:L/Au:N/C:C/I:C/A:C

0.912 High

EPSS

Percentile

98.9%