HP BSM Platform Application Performance Management System Health Directory Traversal Vulnerability

Bugtraq ID:	101596
Class:	Input Validation Error
CVE:	CVE-2017-13985
Remote:	Yes
Local:	No
Published:	Sep 29 2017 12:00AM
Updated:	Dec 19 2017 08:00PM
Credit:	rgod
Vulnerable:	HP BSM Platform Application Performance Management System Health 9.40 HP BSM Platform Application Performance Management System Health 9.30 HP BSM Platform Application Performance Management System Health 9.26
Not Vulnerable:

HP BSM Platform Application Performance Management System Health Directory Traversal Vulnerability

HP BSM Platform Application Performance Management System Health is prone to a directory-traversal vulnerability because it fails to properly sanitize user-supplied input.

Remote attackers may use a specially crafted request with directory-traversal sequences ('../') to retrieve arbitrary files from the affected system in the context of the application. Information obtained could aid in further attacks.

HP BSM Platform Application Performance Management System Health versions 9.26, 9.30 and 9.40 are vulnerable.

HP BSM Platform Application Performance Management System Health Directory Traversal Vulnerability

An attacker can exploit the issue through a browser.

HP BSM Platform Application Performance Management System Health Directory Traversal Vulnerability

Solution:
Updates are available. Please see the references or vendor advisory for more information.

HP BSM Platform Application Performance Management System Health Directory Traversal Vulnerability

References:

• ESB-2017.2274 - [Win][RedHat] HPE BSM Platform Application Performance Managemen (auscert.org.au)
  
• HP HomePage (HP)
  
• ZDI-17-721: Hewlett Packard Enterprise Application Performance Management System (ZDI)