SkipNavigation
Home | FAQ | Contact | Privacy Policy
US-CERT
American Flag
  Vulnerability
Notes
Database

Search Vulnerability Notes

Vulnerability Notes Help Information


 
 View Notes By
  Name

ID Number

CVE Name

Date Public

Date Published

Date Updated

Severity Metric
 Other Documents
  Technical Alerts

Technical Bulletins

Alerts

Security Tips

Vulnerability Note VU#292457

HP System Management Homepage cross-site scripting vulnerability

Overview

The HP System Management Homepage contains a cross-site scripting vulnerability.

I. Description

The HP System Management Homepage (SMH) server is a web-based interface that can manage HP servers running the Microsoft Windows or Linux operating systems.

The SMH contains an unspecified cross-site scripting vulnerability.

II. Impact

An attacker may be able to obtain sensitive data, corrupt or steal cookies, or take any action that the SMH server can.

III. Solution

Upgrade

HP has released SMH version 2.1.8-17 to address this issue.

Restrict access

Restricting network access to the SMH server using a firewall or access control lists may mitigate this vulnerability.

Systems Affected

VendorStatusDate NotifiedDate Updated
Hewlett-Packard CompanyVulnerable5-Jun-2007

References


http://h18013.www1.hp.com/products/servers/management/agents/index.html
http://h20000.www2.hp.com/bc/docs/support/SupportManual/c00293371/c00293371.pdf
http://secunia.com/advisories/25493/

Credit

Thanks to HP for information that was used in this report.

This document was written by Ryan Giobbi.

Other Information

Date Public:2007-06-05
Date First Published:2007-06-05
Date Last Updated:2007-06-05
CERT Advisory: 
CVE-ID(s): 
NVD-ID(s): 
US-CERT Technical Alerts: 
Metric:0.13
Document Revision:12

If you have feedback, comments, or additional information about this vulnerability, please send us email.
 

 
Page Corner Image
Produced 2007 by US-CERT, a government organization
Disclaimers and copyright information
Get Adobe Reader Get Adobe Reader